Cisco patches exploited ASA and FTD flaw that reboots firewalls via SSL VPN

On August 11, 2026, Cisco told customers that attackers were exploiting CVE-2026-20349, a denial-of-service flaw in Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, according to SecurityWeek. A remote, unauthenticated attacker can send a crafted HTTP request to the Remote Access SSL VPN service and force the appliance to reload. Cisco released hotfixes, and CISA added the bug to its Known Exploited Vulnerabilities catalog the same day, giving federal agencies until August 14 to patch. SecurityWeek noted it was the 12th Cisco product bug with a 2026 CVE added to the KEV list this year.

A firewall that reboots on demand is a business-continuity problem. Every reload drops remote users, site-to-site tunnels and any traffic that depends on the device, and repeated reloads can take an office offline. Because no login is required, any ASA or FTD with the SSL VPN service exposed to the internet is a potential target.

Ask whoever manages your Cisco firewalls whether Remote Access SSL VPN is enabled and internet-facing, and whether the hotfix from Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF has been applied. Get the specific fixed release in writing, since the advisory lists affected and fixed versions by train. If you rely on a single firewall for remote access, this is also a good time to confirm you have a failover unit or a documented fallback for remote workers.

Cisco has not shared details about the attacks themselves. Watch for an updated advisory, and treat any unexplained firewall reloads since early August as worth investigating.