CVE-2026-20349: Cisco ASA and FTD VPN Flaw, Patch Deadline Is Today

Cisco disclosed CVE-2026-20349 on August 11 with an admission most vendors avoid making at disclosure time: they already knew someone was exploiting it. Three days later, that’s today, CISA’s remediation deadline for federal agencies runs out. If you run ASA or FTD with remote-access VPN turned on anywhere in your infrastructure, this is the one to check before anything else on your list.

What the bug actually does

CVE-2026-20349 is a heap inspection flaw, tracked as CWE-244, in the code that handles HTTP requests for Cisco Secure Firewall ASA and FTD’s remote-access VPN services. An unauthenticated attacker sends one specially crafted HTTP request. Insufficient error checking in how the device processes it triggers a memory handling fault, and the device reloads. No credentials, no session, no user interaction required.

The CVSS score is 8.6, high but not maximum, because the impact is availability rather than code execution or data exposure. That distinction matters for triage, but it shouldn’t lower your urgency much. A VPN gateway that keeps rebooting isn’t a minor inconvenience: it’s the single device your remote workforce, your branch offices, and often your third-party contractors depend on to reach anything behind your perimeter.

# The exploit path in one line:
# unauthenticated HTTP request -> heap inspection error in VPN request handler -> device reload -> DoS

Who’s actually exposed

This is the detail worth checking before you assume you’re affected, or before you assume you’re not. The flaw only triggers through specific remote-access VPN features:

Feature	Platform	Exposed?
IKEv2 remote access VPN with client services	ASA and FTD	Yes
SSL VPN	ASA and FTD	Yes
Zero Trust Network Access (ZTNA)	FTD only	Yes
Site-to-site VPN only, no remote access	ASA and FTD	No
Firewall with no VPN services enabled	ASA and FTD	No

If your ASA or FTD appliances are running purely as site-to-site VPN endpoints or straight firewalls with no remote-access services turned on, this specific bug doesn’t reach you, even on an unpatched version. If any of the three services above are enabled, an internet-facing appliance is reachable by anyone who can send it a crafted request, not just people who already have a foothold on your network.

Why this one skipped the usual disclosure lag

Most CVE advisories describe a flaw first and confirm exploitation later, if at all. Cisco’s PSIRT statement here went the other way: they said they became aware of exploitation attempts before publishing the fix, which is the strongest possible signal that this isn’t a theoretical bug sitting in a research report. CISA’s own KEV entry, added the same day as Cisco’s advisory, exists specifically because there was already evidence of real attacks, not because a 8.6 CVSS score crossed some automatic threshold. The KEV catalog only lists vulnerabilities with confirmed active exploitation; it’s not a severity ranking.

That combination, disclosed and already-exploited on the same day, with a three-day remediation window, is why this one is worth treating as urgent even if you triage CVEs by CVSS score under a general rule of “patch critical, schedule high.” An actively exploited 8.6 belongs ahead of most theoretical 9s on your list this week.

Fixed versions

Cisco shipped hotfixes across both the ASA and FTD release trains:

Platform	Fixed releases
FTD	7.0.9.1-1, 7.2.11.1-2, 7.4.7.1-1, 7.6.4.1-2, 7.7.11.1-2, 10.0.0.1-2
ASA	9.16.89.18.4.50, 9.18.89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221

Cisco has not published a configuration workaround that closes the hole while keeping the affected VPN services running. The only way to remove the exposure without patching is to disable IKEv2 remote access with client services, SSL VPN, and FTD ZTNA outright, which for most organizations means cutting off remote access entirely. That’s rarely tenable for more than a short maintenance window, which is exactly why the patch itself is the real fix here, not a stopgap you can live with for weeks.

What to check today

Pull your ASA and FTD inventory and cross-reference software versions against the fixed-release table above, not just against “did we patch something Cisco-related this month.” A device running an older build with none of the three affected services turned on is a lower priority than a fully current build that happens to have SSL VPN enabled for a dozen remote employees. Prioritize by exposure, not just by version number.

If you’re running FMC-managed FTD deployments, this is also worth cross-checking against the CVE-2026-20079 authentication bypass we covered earlier this month. That’s a different bug in a different Cisco product (FMC, not ASA/FTD directly), but if your team manages both, this is a reasonable week to run one consolidated Cisco patch sweep instead of chasing each advisory separately.

The pattern across Cisco’s last several disclosures this year has been the same: VPN and firewall management surfaces, unauthenticated attack paths, and a KEV entry landing within days of the advisory. If your organization is still triaging these one at a time as they arrive, rather than treating “internet-facing Cisco VPN infrastructure” as a standing watch list, that process gap is worth fixing before the next one shows up. Teams we’ve worked with through security-focused engagements tend to close this gap by tying vendor advisory feeds directly into their patch management SLAs, so a KEV addition triggers a same-day review instead of waiting for the next scheduled maintenance window.