TL;DR

CVE-2026-20349 is a CVSS 8.6 unauthenticated denial-of-service on Cisco Secure Firewall ASA and FTD via the Remote Access SSL VPN service. CISA added it to KEV on August 11 with a due date of August 14 — three days ago. The vulnerability is caused by insufficient error checking when processing specific SSL packets, leading to an unexpected device reload. If you have internet-facing ASA or FTD with SSL VPN enabled, patch or apply the workaround now.

The Vulnerability

Cisco published the advisory on August 10:

A vulnerability in the Remote Access SSL VPN service for Cisco ASA Software and Cisco FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service condition.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (8.6 — High)

Class: Insufficient error checking in the SSL VPN packet processing path. A specifically crafted SSL handshake triggers an internal error state that causes the device to reload. No authentication required. No user interaction.

Why 8.6 Is the Right Score

This isn’t an RCE, so it’s not a 9.8. But it is:

  • Unauthenticated — anyone who can reach the SSL VPN port can trigger it
  • Low complexity — no specific sequence, just a malformed packet
  • Affects availability — device reloads, killing all active VPN sessions
  • Scope unchanged — the device itself reloads, no lateral impact beyond the VPN

An 8.6 for a firewall is not a throwaway. Reload a perimeter firewall and you either cut off your remote workforce or expose your internal network depending on fail-open settings.

Affected Products

From the Cisco advisory:

  • All ASA versions with SSL VPN enabled
  • All FTD versions with SSL VPN enabled
  • ASA Cloud — not affected (Cisco manages the underlying firmware)

Fixed versions: Refer to the Cisco advisory for version-specific fix information.

CISA Due Date Dynamics

CISA’s KEV catalog gives organizations 42 days from the date of vulnerability disclosure to patch. For CVE-2026-20349:

Event Date Days ago
CVE disclosed Aug 10 7
CISA added to KEV Aug 11 6
KEV due date Aug 14 3

Three days past the due date is still tight, but it’s also the inflection point. Most organizations patch within the first week. If you haven’t patched a KEV entry by day 3 past the due date, you’re likely in the “can’t reboot right now” or “waiting for change window” category.

What To Do

  1. Check your inventory. Run show version on your ASA or ftd version on your FTD. Note the exact build number.
  2. Determine if SSL VPN is enabled. On ASA: show running-config | include ssl-proxy or check for crypto vpn configurations. On FTD, check the VPN configuration in the management interface.
  3. If SSL VPN is NOT in use, you’re safe. Disable it on ASA/FTD and move on.
  4. If SSL VPN IS in use, apply the Cisco patch or workaround. For ASA, the workaround is typically to apply an ACL that restricts access to the SSL VPN port (TCP 443) to known IP ranges.
  5. Verify the fix. After patching, send a crafted SSL packet to the VPN service and confirm the device doesn’t reload:
# On a test system, send a malformed SSL ClientHello to trigger the DoS
python3 -c "
import ssl, socket, sys

ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('asa.example.com', 443))
try:
    s = ctx.wrap_socket(s)
    # Send malformed packet
    s.send(b'\x16\x03\x00\x00\x20' + b'\xff' * 30)
    resp = s.recv(1024)
    if not resp:
        print('Connection reset — DoS confirmed')
    else:
        print('Connection alive — patched')
except Exception as e:
    print(f'Error: {e}')
s.close()
"

The Pattern

This is the same story we saw last week with TeamCity (CVE-2026-63077, KEV due Aug 8): CISA adds a high-value target to KEV with a 42-day clock, and most organizations that matter patch within the first week. The difference this time is the target: ASA/FTD firewalls are harder to patch than application servers because a reload drops all active connections.

If your ASA/FTD SSL VPN is internet-facing and you haven’t patched this, you’re at risk of a reload at any moment. The PoC is simple, the impact is real, and the fix is available.

References