Cisco confirmed this week that attackers are exploiting CVE-2026-20349 to reboot its firewalls, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 11, 2026.
What to Know?
- CVE-2026-20349 lets an unauthenticated attacker crash Cisco Secure Firewall ASA and Threat Defense appliances with one crafted HTTP request.
- CISA set August 14, 2026 as the remediation deadline for US civilian federal agencies running affected hardware.
- Cisco released hot fixes covering ASA 9.16 through 9.24 and FTD 7.0 through 10.0, with no workaround for anyone who cannot patch.
- Affected devices run IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access.
- Cisco published no indicators of compromise, so defenders have nothing to hunt with and no way to confirm a hit.
How It Happened?
The bug lives in the Remote Access SSL VPN service shared by Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. An attacker sends a specially crafted HTTP request to that service and the appliance reloads unexpectedly, with no credentials required and nothing for a user to click. The result is downtime, and Cisco describes no other impact.
Exposure depends on configuration as much as on version. A device is reachable only if it runs affected software and has one of three features turned on: IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access, which is what keeps the SSL listen sockets open. A firewall on an affected build with all three disabled is not exposed through this path.
Cisco’s Product Security Incident Response Team said it became aware of active exploitation in August 2026, and the company has kept the attack detail off the record. Its advisory is blunt about the fix path:
Which Builds Cisco Patched?
The Cisco security advisory lists a hot fix for each supported train, downloadable from the Software Center:
| Software | Affected release | Hot fix build |
|---|---|---|
| ASA | 9.16 | 89.16.4.50 |
| ASA | 9.18 | 89.18.4.50 |
| ASA | 9.20 | 9.20.4.235 |
| ASA | 9.22 | 9.22.3.191 |
| ASA | 9.23 | 9.23.1.211 |
| ASA | 9.24 | 9.24.1.221 |
| FTD | 7.0 | GC-7.0.9.1-1 |
| FTD | 7.2 | HM-7.2.11.1-2 |
| FTD | 7.4 | HK-7.4.7.1-1 |
| FTD | 7.6 | DD-7.6.4.1-2 |
| FTD | 7.7 | AN-7.7.11.1-2 |
| FTD | 10.0 | S-10.0.0.1-2 |
One detail will bite anyone patching in a hurry. The ASA hot fixes for 9.16 and 9.18 carry version strings that start with 89, and Cisco says those builds require ASDM Release 7.24.1.374, because earlier ASDM releases do not recognize that numbering format. Teams on ASA 9.20 and later avoid the problem entirely. Cisco also points administrators at its Software Checker to confirm which advisories touch a given release, and FTD upgrades follow the standard Secure FMC upgrade guide.
What the Advisory Does Not Say?
Cisco confirmed exploitation and dated its own awareness to this month, and that is where the public record stops. The advisory does not say who is doing it, how many appliances have reloaded, whether the crashes cluster in one sector, or whether the same actor is chaining this with anything else. Reading a reboot as an attack is guesswork right now, since Cisco published no file hashes, no source ranges, and no log signature.
For anyone already running an affected build with SSL VPN, ZTNA, or IKEv2 client services live, the useful work today is checking unexplained reloads in the appliance logs against early August, confirming the ASDM version before touching a hot fix that starts with 89, and treating that hot fix as a stopgap rather than the finish line. Patching promptly helps reduce risk of an outage. It does not prevent one, and Cisco has not claimed otherwise.
SQ Magazine’s Takeaway
An unauthenticated reboot bug in an edge VPN is not exotic, and that is precisely why this one matters: the affected service is the box remote workers sign in through every morning, so a successful request takes the firewall and the workforce down together. The federal deadline of August 14 is the tightest signal in the disclosure.
CISA reserves that pace for flaws already causing damage, and it landed three days after the catalog entry. Anyone outside the federal mandate should treat that date as their own ceiling, especially given the absence of [indicators of compromise to work from.
What’s next: Cisco will fold these hot fixes into full maintenance releases, and its own advisory frames the hot fix as temporary until that upgrade exists, so patching teams should expect a second maintenance window. Watch for a technical writeup once exploitation detail clears, and expect scanning against exposed ASA and FTD VPN endpoints to climb now that the vulnerability is public.
