Unauthenticated attackers exploit Cisco firewall flaws to cause remote device crashes

Summary

Cisco has issued an urgent warning regarding a high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2026-20349, that is currently being exploited in the wild. The flaw impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software when certain remote access services are enabled.

The vulnerability allows an unauthenticated, remote attacker to cause the affected device to reload unexpectedly. This results in a complete denial of service for any users relying on those VPN or network access services. Cisco became aware of active exploitation in August 2026, though specific targets and threat actors have not been identified.

What happened

The vulnerability stems from insufficient error checking when the software processes HTTP requests within its Remote Access SSL VPN service. By sending a specifically crafted HTTP request, an attacker can trigger a device reload.

This flaw is particularly critical because it requires no authentication or user interaction to execute. The attack surface includes any configuration where SSL listen sockets are enabled through specific features:

• IKEv2 Remote Access VPN (with client services)
• SSL VPN (webvpn)
• Zero Trust Network Access (on FTD devices)

Cisco confirmed that the Secure Firewall Management Center (FMC) is not affected by this specific vulnerability.

Affected products and fixed versions

The following table outlines the vulnerable software releases and the corresponding hot fixes required to remediate the issue.

Cisco Secure Firewall ASA Hot Fixes

Note: For ASA hot fixes starting with '89', users must also install ASDM Release 7.24.1.374.

Cisco Secure FTD Hot Fixes

Why this matters for defenders

Because the vulnerability can be triggered remotely without credentials, any device exposing SSL VPN or IKEv2 services to the internet is at risk of a sudden crash and reload. This can disrupt entire remote workforces or critical network connectivity.

There are no available workarounds to mitigate this risk; upgrading to the fixed software versions listed above is the only way to prevent exploitation.

Secondary Vulnerability: ClamAV in Secure Endpoint Connector

Separately, Cisco has disclosed that its Secure Endpoint Connector software-running on Windows, Mac, and Linux-is vulnerable to several ClamAV flaws. These vulnerabilities could allow a remote attacker to cause a denial of service by interrupting scanning operations via crafted files (such as zip or GPT files).

The impact is higher on Windows platforms because the ClamAV process runs in a privileged security context there. On Linux and Mac, the impact is considered medium due to lower-privileged execution.

Patches for the Secure Endpoint Connector are expected to be released later in August 2026. Customers using Secure Endpoint Private Cloud should prepare to push these updates once they become available.