Cisco VPN Gateways Knocked Offline: CVE-2026-20349, Scope and Fixes

A flaw has been found in Cisco's firewalls — the boxes many companies rely on to let staff reach the corporate network from outside — that lets anyone reboot the device from across the internet with no login and no password, cutting the connection. It is tracked as CVE-2026-20349, rated 8.6 out of 10.

Three things stack up badly here. It is already being used in real attacks. There is no workaround at all. And the U.S. government set a remediation deadline of August 14 — three days after the August 11 disclosure, an unusually short window.

Some reassurance first: no data is stolen through this flaw, and nothing is altered. What happens is that the device reboots and traffic drops. But the traffic that drops is remote-work connections and site-to-site links, so the damage takes the shape of work grinding to a halt. If you run a Cisco firewall with remote-access VPN enabled, check today whether you are in scope.

What these boxes actually do

Two products are affected: Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD). Different names, but both are firewalls — devices that sit at the boundary between the company and the outside world and decide which traffic is allowed through.

The part at issue is the feature that lets people connect in from outside. When you work from home or on the road, in many companies it is this device that verifies who you are and builds an encrypted path back into the network. That is the VPN. The flaw is in how that entry point handles incoming requests.

What matters is that this entry point cannot do its job unless it faces the internet. It exists so people can reach it from outside. Which means it is visible to attackers from the start — a different class of risk from a server buried deep inside the network.

Note that Secure Firewall Management Center (FMC), the product used to manage these devices, is not affected. Same vendor, different product. We covered a separate flaw in FMC earlier.

What CVE-2026-20349 does

The mechanism is simple. Cisco's advisory attributes it to "insufficient error checking when processing HTTP requests." Send one crafted request and the device fails to handle it cleanly, then reloads. That is the whole of it.

The reason the score lands as high as 8.6 is that the impact does not stay inside the box. The scoring includes a "scope changed" flag: one device breaks, but everything routed through that device goes down with it. That is how a flaw rated as causing no data exposure and no tampering still reaches 8.6.

Who goes after this, and what it costs you

Plainly: nobody has said who is attacking. Cisco states only that it "became aware of active exploitation" in August 2026. No actor name, no indicators of compromise, no targeted sectors have been published. That gap has to be reported as a gap.

What an attacker can do here is knock out the path between a company and the outside world — and nothing more. No data extraction, no device takeover. Which leaves the question of why anyone would bother. The plausible answers are disruption as the goal in itself, or disruption in service of something else.

What gets lost splits cleanly by role. For employees it shows up as arriving one morning unable to reach anything: no timesheets, no expense claims, no file transfers between offices. For the IT team, because no authentication is needed and the request can be resent from anywhere, the same thing can be done again until the patch is applied. What a downed VPN device does to a business is something we examined concretely in a case where financial reporting itself stalled.

For context, Cisco firewalls were the target of a suspected state-backed campaign in 2025, in which attackers deliberately crashed devices to frustrate investigation. This flaw is precisely a way to crash a device — but no published information connects the two. The association is easy to make and not yet supportable, so we leave it as an observation.

How to tell whether your device is in scope

Running ASA or FTD does not automatically mean you are affected. The dividing line is whether the device accepts inbound connections from outside. Cisco lists three configurations, any one of which puts you in scope.

Put another way: devices accepting VPN connections from outside are in scope. A device used purely to segment internal networks, with no external entry point open, is not. Check the configuration rather than assuming.

What to upgrade to — note these are hotfixes

A caveat matters here. What Cisco shipped is not a normal release but an emergency hotfix that closes this one hole. The identifiers differ per train, so find your row.

One trap. On ASA, if you are applying a hotfix whose number starts with "89" (the 9.16 and 9.18 trains), you need ASDM at 7.24.1.374 or later. Older ASDM versions do not recognize that numbering scheme and will not handle it correctly. Upgrade ASDM first, then apply the hotfix.

For FTD, files are split by hardware platform within the same train (FP1K / FP2K / FP3K and the various series). Pick the one matching your model from the download section of the advisory.

Note that ASA trains 9.12 / 9.14 / 9.17 / 9.19 and FTD trains 7.1 / 7.3 / 7.5 do not appear in the advisory table at all. They are most likely end-of-support, but Cisco does not say so explicitly. If you are on one of them, ask Cisco support directly.

What is confirmed and what is not

On exposure counts: nobody has counted the devices affected by this particular flaw yet. For scale only, a September 2025 survey of a different flaw found more than 48,800 exposed worldwide, about 2,300 of them in Japan. Those are not this month's numbers, but they give a sense of how many Cisco firewalls sit on the internet.

Update, August 17, 2026: The Deadline Passed and Almost Nothing Moved

Three days have gone by since the August 14 federal remediation deadline. We went back through the primary sources, and almost no new facts have surfaced. Nothing here calls for emergency action beyond what this article already recommended. The one lasting task: no permanent release exists yet, so hotfixed devices still need tracking.

Cisco's advisory is untouched, and there are still no indicators

We pulled Cisco's advisory on August 17 and checked the revision history: it is still Version 1.0, first published August 11, with no revisions. The exploitation note reads exactly as it did at launch. No threat actor, no targeted sectors, no observation counts, and no indicators of compromise (IoCs) have been published.

Two operational details worth extracting: the internal bug ID is CSCwv96220, and Cisco lists Snort (software that spots attack patterns in network traffic) rules 46897 and 59654 for detection. If you run traffic inspection, confirm those two rules are enabled.

No follow-up from CISA either

We checked CISA's advisory feed after the deadline: no new alert or emergency directive on Cisco ASA/FTD. The KEV entry itself is unchanged from the August 11 listing.

Exposure counts have not moved either. Shadowserver's list of tracked CVEs (the nonprofit that counts exposed devices daily) carries 48 entries from 2026, and CVE-2026-20349 is not among them. Daily measurement for this flaw has not started. Censys has no advisory entry either. The 48,800 figure quoted earlier in this article belongs to a different 2025 flaw, and we repeat that caveat here.

NVD and Cisco disagree on which versions are affected

This is the finding with real operational weight. NVD finalized its affected-product list on August 12, and it includes ASA 9.19.1.x (thirteen versions, 9.19.1 through 9.19.1.42) and FTD 7.3.0 / 7.3.1 / 7.3.1.1 / 7.3.1.2.

Cisco's fixed-software tables contain no hotfix for the 9.19 or 7.3 trains at all — only ASA 9.16 / 9.18 / 9.20 / 9.22 / 9.23 / 9.24 and FTD 7.0 / 7.2 / 7.4 / 7.6 / 7.7 / 10.0. There is no "migrate to a fixed release" note and no end-of-support statement.

If you run 9.19 or 7.3, open a case with Cisco. The database says you are vulnerable and there is nothing to install. ASA 9.12 / 9.14 / 9.17 and FTD 7.1 / 7.5 appear in neither list, so their status is simply undocumented. JVN iPedia draws the boundary differently again, at "FTD 7.0.x through 7.7.13 and 10.0.x / ASA 9.16.x through 9.24.1."

Still no permanent release

As of August 17 the fixed-software section is still two hotfix tables, with no ordinary maintenance release (no 9.20.5, no 9.22.4). The unusual 89.16.4.50 / 89.18.4.50 numbering stands, along with the note that ASDM 7.24.1.374 is required for the 89-prefixed builds because older ASDM cannot parse that scheme. Treat hotfixed devices as needing a second pass once a permanent release ships.

Still no link to the earlier state-backed campaigns

Cisco firewalls have been targeted by suspected state actors before. But Cisco's ArcaneDoor event response page lists only CVE-2024-20353 / 20358 / 20359, and the page for the campaign continuing since 2025 (last updated April 24, 2026) lists only CVE-2025-20333 / 20362 / 20363. Neither mentions CVE-2026-20349. The KEV ransomware field remains "Unknown." This article never asserted a connection, and as of August 17 there is still nothing to assert.

Japan is still quiet

JPCERT/CC's 2026 advisory index lists NetScaler, Metabase, Microsoft, and Rails for August — nothing on Cisco ASA/FTD. IPA's critical security notices show one August item, for Microsoft products.

One correction to what we published on August 12. We wrote that JVN had nothing; in fact JVN iPedia registered JVNDB-2026-028127 on August 11 (updated August 13, CVSS v3 8.6, CWE-244), so it already existed. That is an automated database record rather than a Japanese-language advisory, but the original wording was wrong and we are correcting it. Domestic coverage remains the single Security NEXT piece from August 12, which covers the CVE number, severity, hotfixes, and the fact that FMC is unaffected, but does not mention the KEV listing or the August 14 deadline. No follow-ups appeared.

A loose end: Cisco's own classification does not match the flaw

A small point, recorded for accuracy. This flaw carries the classification CWE-244, which describes memory being released without clearing its contents, so that someone else can read what was left behind — an information-disclosure weakness.

But this flaw is scored with no confidentiality impact, no integrity impact, and availability only. The stated cause is insufficient error checking on HTTP requests, not uncleared memory. The label and the substance do not line up.

The reason the U.S. catalog lists this as a "Heap Inspection Vulnerability" is that the name was derived mechanically from that classification. This is not a CISA error; it traces back to how Cisco classified it. Nothing about the remediation changes, but readers who see the name and assume data was exposed would be misreading it, so it is worth stating.

What to do now

In order. First, check whether your ASA or FTD has one of the three configurations enabled. If it accepts VPN connections from outside, assume it is in scope.

Second, apply the hotfix. It is the only remedy; there is no workaround. On the 9.16 and 9.18 trains, upgrade ASDM to 7.24.1.374 or later first. Patching a firewall means a reboot and therefore an outage. Think of it as choosing when the connection drops, rather than letting an attacker choose, and schedule accordingly.

If you cannot patch immediately, the usual advice would be to disable the feature or restrict who can reach it — neither works here, because the feature to disable is external access itself. If your environment allows restricting VPN sources to a known set of office addresses, that removes you from indiscriminate scanning. Most companies cannot pin down where home workers connect from.

Finally, check whether you were hit. Since this flaw does not steal anything, there is no need to rotate credentials afterwards. It is worth reviewing logs for unexplained device reboots in recent weeks. Cisco also points to Snort detection rules 46897 and 59654.

Frequently asked questions

Summary

CVE-2026-20349 is not a flaw that steals anything. All it does is drop the path between a company and the outside world. The reasons to move fast come down to three: it is already being exploited, there is no workaround, and no authentication is needed so it can be repeated. That combination is presumably why the U.S. government set a deadline just three days after disclosure.

The task is clear. Check whether you have an ASA or FTD accepting VPN connections from outside, apply the hotfix matching your train, and upgrade ASDM first on the 9.16 and 9.18 trains. The update reboots the device, so do it while you still get to choose the timing. Left to an attacker, the timing is never convenient.

In Japan, nothing has appeared from JPCERT/CC, IPA, or JVN as of August 12. The local advisory space is empty while the deadline closes in. We will update this article as more emerges.

Sources

• ▸Cisco Security Advisory - Secure Firewall ASA and FTD Remote Access SSL VPN Denial of Service Vulnerability (August 11, 2026)
• ▸NVD - CVE-2026-20349
• ▸CISA - Known Exploited Vulnerabilities Catalog
• ▸CISA - Three vulnerabilities added on August 11, 2026
• ▸CISA - BOD 26-04: Prioritizing Security Updates Based on Risk
• ▸BleepingComputer - Cisco warns of ASA and FTD VPN flaw exploited to crash devices
• ▸Security NEXT - DoS flaw in Cisco firewall SSL VPN, zero-day attacks observed (Japanese, August 12, 2026)
• ▸BleepingComputer - September 2025 exposure survey (numbers for a different flaw)
• ▸Related: flaw in Cisco's firewall management software (this site)
• ▸Related: Cisco IOS XE vulnerability round-up (this site)
• ▸Related: CISA KEV dashboard (this site)
• •NVD "CVE-2026-20349" (updated August 12, 2026; affected-product list finalized)
• •JVN iPedia "JVNDB-2026-028127" (registered August 11, updated August 13, 2026)
• •Shadowserver "Vulnerable HTTP Report" (tracked-CVE list; this CVE absent)
• •Cisco "Continued Attacks Against Cisco Firewalls" (last updated April 24, 2026)
• •JPCERT/CC 2026 advisory index (confirmed no entry for this flaw)

Revision History

• •August 17, 2026: Added the post-deadline picture. Cisco's advisory is still v1.0, with no IoCs, no permanent release, no follow-up CISA alert, and no exposure telemetry. Added the discrepancy where NVD marks ASA 9.19.1.x and FTD 7.3.x as affected while Cisco ships no hotfix for those trains. Correction: the original article said JVN had no entry; JVN iPedia had in fact registered JVNDB-2026-028127 on August 11. We regret the error. JPCERT/CC and IPA advisories remain at zero as of August 17.
• •August 12, 2026: Published