CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why
Brief
An unauthenticated attacker can crash any Cisco ASA or FTD with SSL VPN exposed; it’s been confirmed exploited in the wild, and Cisco hasn’t told us who or why.
Attackers Can Force Your Firewall To Reboot
If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3. 1 score of 8.
- The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices.
Cisco describes the vulnerability as “insufficient error checking when processing HTTP requests,” which allows an unauthenticated remote attacker to send a crafted HTTP request and trigger an unexpected device reboot. The entire attack can be executed in one packet and requires no credentials or user interaction.