Fixing and finding
Jump to remediation plan
CVE ID
CVE-2026-20349
Published 2026-08-11
Updated 7 days ago
Vendor/s
Cisco
Product/s
Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Version/s
9.16.1
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active
exploitation observed in the wild.
CVSS Score (v3.1)
8.6
/ 10
High
Severity Details
Base score
8.6 High
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Description
CVE-2026-20349 is a high-severity DoS vulnerability in Cisco ASA and FTD SSL VPN services. Actively exploited; update affected systems immediately.
CPE
Cisco
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| adaptive_security_appliance_software | 9.16.1 | 9.16.1 | vulnerable |
| adaptive_security_appliance_software | 9.16.1.28 | 9.16.1.28 | vulnerable |
| adaptive_security_appliance_software | 9.16.2 | 9.16.2 | vulnerable |
| adaptive_security_appliance_software | 9.16.2.3 | 9.16.2.3 | vulnerable |
| adaptive_security_appliance_software | 9.16.2.7 | 9.16.2.7 | vulnerable |
| adaptive_security_appliance_software | 9.16.2.11 | 9.16.2.11 | vulnerable |
| adaptive_security_appliance_software | 9.16.2.13 | 9.16.2.13 | vulnerable |
| adaptive_security_appliance_software | 9.16.2.14 | 9.16.2.14 | vulnerable |
| adaptive_security_appliance_software | 9.16.3 | 9.16.3 | vulnerable |
| adaptive_security_appliance_software | 9.16.3.3 | 9.16.3.3 | vulnerable |
| adaptive_security_appliance_software | 9.16.3.14 | 9.16.3.14 | vulnerable |
| adaptive_security_appliance_software | 9.16.3.15 | 9.16.3.15 | vulnerable |
| adaptive_security_appliance_software | 9.16.3.19 | 9.16.3.19 | vulnerable |
| adaptive_security_appliance_software | 9.16.3.23 | 9.16.3.23 | vulnerable |
| adaptive_security_appliance_software | 9.16.4 | 9.16.4 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.9 | 9.16.4.9 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.14 | 9.16.4.14 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.19 | 9.16.4.19 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.27 | 9.16.4.27 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.38 | 9.16.4.38 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.39 | 9.16.4.39 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.42 | 9.16.4.42 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.48 | 9.16.4.48 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.55 | 9.16.4.55 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.57 | 9.16.4.57 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.61 | 9.16.4.61 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.62 | 9.16.4.62 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.67 | 9.16.4.67 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.70 | 9.16.4.70 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.71 | 9.16.4.71 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.76 | 9.16.4.76 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.82 | 9.16.4.82 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.84 | 9.16.4.84 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.85 | 9.16.4.85 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.89 | 9.16.4.89 | vulnerable |
| adaptive_security_appliance_software | 9.16.4.92 | 9.16.4.92 | vulnerable |
| adaptive_security_appliance_software | 9.18.1 | 9.18.1 | vulnerable |
| adaptive_security_appliance_software | 9.18.1.3 | 9.18.1.3 | vulnerable |
| adaptive_security_appliance_software | 9.18.2 | 9.18.2 | vulnerable |
| adaptive_security_appliance_software | 9.18.2.5 | 9.18.2.5 | vulnerable |
| adaptive_security_appliance_software | 9.18.2.7 | 9.18.2.7 | vulnerable |
| adaptive_security_appliance_software | 9.18.2.8 | 9.18.2.8 | vulnerable |
| adaptive_security_appliance_software | 9.18.3 | 9.18.3 | vulnerable |
| adaptive_security_appliance_software | 9.18.3.39 | 9.18.3.39 | vulnerable |
| adaptive_security_appliance_software | 9.18.3.46 | 9.18.3.46 | vulnerable |
| adaptive_security_appliance_software | 9.18.3.53 | 9.18.3.53 | vulnerable |
| adaptive_security_appliance_software | 9.18.3.55 | 9.18.3.55 | vulnerable |
| adaptive_security_appliance_software | 9.18.3.56 | 9.18.3.56 | vulnerable |
| adaptive_security_appliance_software | 9.18.4 | 9.18.4 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.5 | 9.18.4.5 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.8 | 9.18.4.8 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.22 | 9.18.4.22 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.24 | 9.18.4.24 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.29 | 9.18.4.29 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.34 | 9.18.4.34 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.40 | 9.18.4.40 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.47 | 9.18.4.47 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.50 | 9.18.4.50 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.52 | 9.18.4.52 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.53 | 9.18.4.53 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.57 | 9.18.4.57 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.66 | 9.18.4.66 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.67 | 9.18.4.67 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.68 | 9.18.4.68 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.71 | 9.18.4.71 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.76 | 9.18.4.76 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.82 | 9.18.4.82 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.90 | 9.18.4.90 | vulnerable |
| adaptive_security_appliance_software | 9.18.4.135 | 9.18.4.135 | vulnerable |
| adaptive_security_appliance_software | 9.19.1 | 9.19.1 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.5 | 9.19.1.5 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.9 | 9.19.1.9 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.12 | 9.19.1.12 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.18 | 9.19.1.18 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.22 | 9.19.1.22 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.24 | 9.19.1.24 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.27 | 9.19.1.27 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.28 | 9.19.1.28 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.31 | 9.19.1.31 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.37 | 9.19.1.37 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.38 | 9.19.1.38 | vulnerable |
| adaptive_security_appliance_software | 9.19.1.42 | 9.19.1.42 | vulnerable |
| adaptive_security_appliance_software | 9.20.1 | 9.20.1 | vulnerable |
| adaptive_security_appliance_software | 9.20.1.5 | 9.20.1.5 | vulnerable |
| adaptive_security_appliance_software | 9.20.2 | 9.20.2 | vulnerable |
| adaptive_security_appliance_software | 9.20.2.10 | 9.20.2.10 | vulnerable |
| adaptive_security_appliance_software | 9.20.2.21 | 9.20.2.21 | vulnerable |
| adaptive_security_appliance_software | 9.20.2.22 | 9.20.2.22 | vulnerable |
| adaptive_security_appliance_software | 9.20.3 | 9.20.3 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.4 | 9.20.3.4 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.7 | 9.20.3.7 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.9 | 9.20.3.9 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.10 | 9.20.3.10 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.13 | 9.20.3.13 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.16 | 9.20.3.16 | vulnerable |
| adaptive_security_appliance_software | 9.20.3.20 | 9.20.3.20 | vulnerable |
| adaptive_security_appliance_software | 9.20.4 | 9.20.4 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.7 | 9.20.4.7 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.10 | 9.20.4.10 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.14 | 9.20.4.14 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.19 | 9.20.4.19 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.22 | 9.20.4.22 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.28 | 9.20.4.28 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.30 | 9.20.4.30 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.34 | 9.20.4.34 | vulnerable |
| adaptive_security_appliance_software | 9.20.4.46 | 9.20.4.46 | vulnerable |
| adaptive_security_appliance_software | 9.22.1.1 | 9.22.1.1 | vulnerable |
| adaptive_security_appliance_software | 9.22.1.2 | 9.22.1.2 | vulnerable |
| adaptive_security_appliance_software | 9.22.1.3 | 9.22.1.3 | vulnerable |
| adaptive_security_appliance_software | 9.22.1.6 | 9.22.1.6 | vulnerable |
| adaptive_security_appliance_software | 9.22.2 | 9.22.2 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.4 | 9.22.2.4 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.9 | 9.22.2.9 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.13 | 9.22.2.13 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.14 | 9.22.2.14 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.20 | 9.22.2.20 | vulnerable |
| adaptive_security_appliance_software | 9.22.2.32 | 9.22.2.32 | vulnerable |
| adaptive_security_appliance_software | 9.22.3 | 9.22.3 | vulnerable |
| adaptive_security_appliance_software | 9.22.3.5 | 9.22.3.5 | vulnerable |
| adaptive_security_appliance_software | 9.23.1 | 9.23.1 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.3 | 9.23.1.3 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.7 | 9.23.1.7 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.13 | 9.23.1.13 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.19 | 9.23.1.19 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.22 | 9.23.1.22 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.26 | 9.23.1.26 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.32 | 9.23.1.32 | vulnerable |
| adaptive_security_appliance_software | 9.23.1.195 | 9.23.1.195 | vulnerable |
| adaptive_security_appliance_software | 9.24.1 | 9.24.1 | vulnerable |
| adaptive_security_appliance_software | 9.24.1.5 | 9.24.1.5 | vulnerable |
| adaptive_security_appliance_software | 9.24.1.9 | 9.24.1.9 | vulnerable |
| adaptive_security_appliance_software | 9.24.1.11 | 9.24.1.11 | vulnerable |
| adaptive_security_appliance_software | 9.24.1.155 | 9.24.1.155 | vulnerable |
| secure_firewall_threat_defense | 7.0.0 | 7.0.0 | vulnerable |
| secure_firewall_threat_defense | 7.0.0.1 | 7.0.0.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.1 | 7.0.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.1.1 | 7.0.1.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.2 | 7.0.2 | vulnerable |
| secure_firewall_threat_defense | 7.0.2.1 | 7.0.2.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.3 | 7.0.3 | vulnerable |
| secure_firewall_threat_defense | 7.0.4 | 7.0.4 | vulnerable |
| secure_firewall_threat_defense | 7.0.5 | 7.0.5 | vulnerable |
| secure_firewall_threat_defense | 7.0.6 | 7.0.6 | vulnerable |
| secure_firewall_threat_defense | 7.0.6.1 | 7.0.6.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.6.2 | 7.0.6.2 | vulnerable |
| secure_firewall_threat_defense | 7.0.6.3 | 7.0.6.3 | vulnerable |
| secure_firewall_threat_defense | 7.0.7 | 7.0.7 | vulnerable |
| secure_firewall_threat_defense | 7.0.8 | 7.0.8 | vulnerable |
| secure_firewall_threat_defense | 7.0.8.1 | 7.0.8.1 | vulnerable |
| secure_firewall_threat_defense | 7.0.9 | 7.0.9 | vulnerable |
| secure_firewall_threat_defense | 7.2.0 | 7.2.0 | vulnerable |
| secure_firewall_threat_defense | 7.2.0.1 | 7.2.0.1 | vulnerable |
| secure_firewall_threat_defense | 7.2.1 | 7.2.1 | vulnerable |
| secure_firewall_threat_defense | 7.2.2 | 7.2.2 | vulnerable |
| secure_firewall_threat_defense | 7.2.3 | 7.2.3 | vulnerable |
| secure_firewall_threat_defense | 7.2.4 | 7.2.4 | vulnerable |
| secure_firewall_threat_defense | 7.2.4.1 | 7.2.4.1 | vulnerable |
| secure_firewall_threat_defense | 7.2.5 | 7.2.5 | vulnerable |
| secure_firewall_threat_defense | 7.2.5.1 | 7.2.5.1 | vulnerable |
| secure_firewall_threat_defense | 7.2.5.2 | 7.2.5.2 | vulnerable |
| secure_firewall_threat_defense | 7.2.6 | 7.2.6 | vulnerable |
| secure_firewall_threat_defense | 7.2.7 | 7.2.7 | vulnerable |
| secure_firewall_threat_defense | 7.2.8 | 7.2.8 | vulnerable |
| secure_firewall_threat_defense | 7.2.8.1 | 7.2.8.1 | vulnerable |
| secure_firewall_threat_defense | 7.2.9 | 7.2.9 | vulnerable |
| secure_firewall_threat_defense | 7.2.10 | 7.2.10 | vulnerable |
| secure_firewall_threat_defense | 7.2.10.2 | 7.2.10.2 | vulnerable |
| secure_firewall_threat_defense | 7.2.11 | 7.2.11 | vulnerable |
| secure_firewall_threat_defense | 7.2.12 | 7.2.12 | vulnerable |
| secure_firewall_threat_defense | 7.3.0 | 7.3.0 | vulnerable |
| secure_firewall_threat_defense | 7.3.1 | 7.3.1 | vulnerable |
| secure_firewall_threat_defense | 7.3.1.1 | 7.3.1.1 | vulnerable |
| secure_firewall_threat_defense | 7.3.1.2 | 7.3.1.2 | vulnerable |
| secure_firewall_threat_defense | 7.4.0 | 7.4.0 | vulnerable |
| secure_firewall_threat_defense | 7.4.1 | 7.4.1 | vulnerable |
| secure_firewall_threat_defense | 7.4.1.1 | 7.4.1.1 | vulnerable |
| secure_firewall_threat_defense | 7.4.2 | 7.4.2 | vulnerable |
| secure_firewall_threat_defense | 7.4.2.1 | 7.4.2.1 | vulnerable |
| secure_firewall_threat_defense | 7.4.2.2 | 7.4.2.2 | vulnerable |
| secure_firewall_threat_defense | 7.4.2.3 | 7.4.2.3 | vulnerable |
| secure_firewall_threat_defense | 7.4.2.4 | 7.4.2.4 | vulnerable |
| secure_firewall_threat_defense | 7.4.3 | 7.4.3 | vulnerable |
| secure_firewall_threat_defense | 7.4.4 | 7.4.4 | vulnerable |
| secure_firewall_threat_defense | 7.4.7 | 7.4.7 | vulnerable |
| secure_firewall_threat_defense | 7.4.8 | 7.4.8 | vulnerable |
| secure_firewall_threat_defense | 7.6.0 | 7.6.0 | vulnerable |
| secure_firewall_threat_defense | 7.6.1 | 7.6.1 | vulnerable |
| secure_firewall_threat_defense | 7.6.2 | 7.6.2 | vulnerable |
| secure_firewall_threat_defense | 7.6.2.1 | 7.6.2.1 | vulnerable |
| secure_firewall_threat_defense | 7.6.4 | 7.6.4 | vulnerable |
| secure_firewall_threat_defense | 7.7.0 | 7.7.0 | vulnerable |
| secure_firewall_threat_defense | 7.7.10 | 7.7.10 | vulnerable |
| secure_firewall_threat_defense | 7.7.10.1 | 7.7.10.1 | vulnerable |
| secure_firewall_threat_defense | 7.7.11 | 7.7.11 | vulnerable |
| secure_firewall_threat_defense | 7.7.13 | 7.7.13 | vulnerable |
| secure_firewall_threat_defense | 10.0.0 | 10.0.0 | vulnerable |
| secure_firewall_threat_defense | 10.0.2 | 10.0.2 | vulnerable |
Related weakness (CWE)
CWE-244
Remediation plan
1
Apply official patches
Download and install the latest software updates from the Cisco Software Central portal for ASA and FTD platforms to address the HTTP processing flaw.
2
Update affected systems
Ensure ASA software is upgraded beyond vulnerable versions in the 9.16 through 9.24 ranges and FTD software is updated beyond versions 7.0 through 10.0.
3
Restrict access
Limit exposure by implementing infrastructure access control lists (iACLs) to permit only trusted source IP addresses to reach the Remote Access SSL VPN interface.
4
Monitor for exploitation
Use Cisco Firepower Management Center or syslog servers to alert on unexpected device reloads and inspect web server logs for malformed HTTP request patterns.
Detection Guidance
"Monitor syslog for 'Device reload' events or crash dumps specifically related to the SSL VPN service. Look for high volumes of malformed HTTP requests or unusual URI patterns targeting the VPN portal. Network Intrusion Prevention Systems (IPS) should be updated with signatures identifying crafted HTTP packets designed to exploit Cisco ASA/FTD vulnerabilities, particularly those targeting the web-based VPN interface."
References
Sources
NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)