Crashes Cisco ASA Firewalls With One HTTP Request

What CISA Added and Why It Matters

On August 11, 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog, confirming that the flaw in Cisco's Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software is being actively exploited, not just theoretically dangerous. Cisco rates it 8.6 on the CVSS scale and traces the root cause to insufficient error checking while the software processes HTTP requests, a category of bug more often filed away as a stability nuisance than a headline security event.

That is precisely why the KEV listing is the signal worth reading. CISA does not add flaws to the catalog because a vendor published an advisory; it adds them because it has evidence real attackers are already using the bug against real networks. An unauthenticated, remote attacker who sends a single crafted HTTP request to the Remote Access SSL VPN service on an affected device can force it to reload, and Cisco has confirmed no workaround exists - patching is the only path off the list of exposed devices.

Why a Denial-of-Service Bug Gets a Three-Day Clock

A vulnerability that only crashes a device, rather than handing an attacker code execution, tends to get triaged as lower priority than it deserves. That instinct misses what ASA and FTD appliances actually do at the edge of a large share of EU enterprise and government networks: they terminate VPN connections, which is the exact function this flaw attacks. For any organization that relies on a single ASA or FTD pair as the sole remote-access path for a hybrid or distributed workforce, an attacker who can crash that device on demand, and keep crashing it after every reload, has effectively cut remote access to the whole organization without ever touching a credential.

CISA's Binding Operational Directive gives US federal civilian agencies a matter of days, not the standard patch-cycle timeline, to remediate flaws added to the KEV catalog - and in this case that deadline landed on August 14, 2026, just three days after the listing. Treat that clock as the benchmark. A denial-of-service rating on paper does not change the fact that this is a business-continuity failure mode for any network where ASA or FTD is the front door.

Which Configurations Are Exposed

The flaw does not touch every ASA or FTD deployment equally. Cisco's advisory narrows the exposure to devices with SSL VPN enabled, IKEv2 remote-access VPN configured with client services, or Zero Trust Network Access turned on - configurations built specifically to let remote employees and contractors reach internal resources. A device with none of those features active, running purely as a site-to-site firewall with no remote-access VPN, is not exposed by this particular bug.

The affected code spans multiple currently shipping ASA and FTD release trains, which is why Cisco is not offering a version-specific mitigation shortcut and is instead pointing every affected customer straight at the patched builds. Given how commonly SSL VPN and IKEv2 remote access are turned on precisely because an organization needs them for a hybrid workforce, the practical exposure among EU deployments running ASA or FTD at the perimeter is likely to be the rule rather than the exception.

Two Other Flaws Joined the Same KEV Batch

CISA did not add CVE-2026-20349 alone on August 11. The same batch included CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock that lets a local attacker escalate to SYSTEM privileges, and which researchers have linked to North Korea's Lazarus Group deploying its FudModule rootkit. It also included CVE-2026-72898, a SQL injection in the Metabase business intelligence platform rated a maximum CVSS 10.0, exploitable without authentication through the password-reset endpoint to gain full administrator access - and from there, every database credential Metabase has stored for the systems it connects to.

Three unrelated products, three different attacker profiles, one KEV batch on one day. That pattern is the point: CISA's catalog is not tracking a single campaign, it is tracking whatever attackers are currently using against whatever software gives them the fastest route in, whether that route runs through a firewall's VPN service, a Windows kernel driver, or a dashboard's password reset form.

The Owner-Level Checklist

If your organization runs Cisco ASA or FTD anywhere at the network perimeter, the first task is not reading the advisory - it is checking configuration. Confirm whether SSL VPN, IKEv2 remote-access VPN with client services, or Zero Trust Network Access is enabled on each appliance, because that answer determines whether this specific flaw applies to you at all. If any of those features are active, treat the patch as due on CISA's clock, not on whatever quarterly maintenance window your change-management process normally allows.

This is a distinct vulnerability from the Cisco Secure Firewall Management Center credential flaw CISA added to the same catalog in July 2026, and distinct again from the eighteen-year-old SNMP bug flagged the month before that. Three separate Cisco entries on the KEV catalog inside six weeks is not a coincidence worth ignoring - it is a reason to move Cisco perimeter devices to the top of the patch queue as a standing policy, not a one-time response to this single bulletin.

Read next: Your MSP's RMM Tool Has a Second Bypass Flaw  |  45,601 Flaws This Year. 171 Are Being Used.