Cisco firewall VPN flaw exploited to crash ASA and FTD devices

Cisco on Aug. 11, 2026, disclosed and confirmed active exploitation of a vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software that lets a remote attacker knock devices offline. The Canadian Centre for Cyber Security issued alert AL26-018 two days later.

The flaw, CVE-2026-20349, does not give attackers access to data, but repeatedly crashing a perimeter firewall can cut an organization off from the internet or disrupt remote workers who depend on the VPN. Cisco ASA and FTD devices are widely deployed in Canadian government and enterprise networks.

What happened

Cisco's advisory says insufficient error checking when processing HTTP requests allows an unauthenticated, remote attacker to send a crafted request to the Remote Access SSL VPN service and force the device to reload. Cisco rated it 8.6, high severity. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day.

Devices are exposed only when a feature that opens SSL listen sockets is enabled: IKEv2 Remote Access VPN with client services, SSL VPN (WebVPN) or, on FTD, Zero Trust Network Access. Secure Firewall Management Center is not affected.

BleepingComputer reported that Cisco has not said who is exploiting the bug, and the advisory includes no indicators of compromise. The flaw was found in Cisco's internal testing and independently reported by researcher Valerio Brussani. There are no workarounds.

The Cyber Centre's alert said internet-accessible devices with these VPN services turned on are most at risk.

Fixed versions

According to the Cyber Centre, fixes include ASA 9.20.4.235, 9.22.3.191, 9.23.1.211 and 9.24.1.221, with fixed builds also listed for the 9.16 and 9.18 trains. FTD hotfixes are available for 7.0.9.1, 7.2.11.1, 7.4.7.1, 7.6.4.1, 7.7.11.1 and 10.0.0.1.

What to do

• Identify internet-facing ASA and FTD devices with Remote Access SSL VPN, IKEv2 client services or ZTNA enabled.
• Use the Cisco Software Checker to find the right fixed release and upgrade, starting with exposed devices.
• Review firewall and VPN logs for unexpected reloads or suspicious HTTP requests to VPN services.
• Make sure perimeter devices are included in regular patch management.

Organizations that detect activity matching the alert can report it to the Cyber Centre through My Cyber Portal or [email protected].