Security teams managing Cisco edge infrastructure must prioritize patching due to a high-priority deadline following Cisco's confirmation of active exploitation of a newly disclosed zero-day in its firewall and VPN stack This article explores according cisco security. . This flaw, tracked as CVE-2026-20349, impacts the Remote Access SSL VPN service within Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, causing unexpected device reloads that result in denial-of-service conditions for remote access and related network paths.
According to Cisco's security advisory, the vulnerability arises from insufficient error checking during the SSL VPN service’s processing of HTTP requests. As many organizations place ASA and FTD devices at their network perimeters, even brief reload windows can disrupt remote workers, site-to-site connectivity, and critical business applications.
Devices become vulnerable only when they run an impacted ASA or FTD release, have specific features enabled that open SSL listen sockets, such as: SSL VPN with WebVPN on a particular interface, IKEv2 Remote Access VPN with client services enabled, and Zero Trust Network Access when the feature is turned on in Cisco Secure Firewall Management Center (FMC) Software. The company has released hot fixes for various ASAs across multiple releases, including 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24, as well as corresponding FTD hot fixes for Cisco IOS versions 7.0 through 10.0 on supported platforms.
