CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20349?
The severity of CVE-2026-20349 is rated as high, with a score of 8.6.
What impact does CVE-2026-20349 have?
CVE-2026-20349 allows an unauthenticated remote attacker to cause the device to unexpectedly reload, leading to a denial of service.
Which Cisco products are affected by CVE-2026-20349?
CVE-2026-20349 affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software.
How can I mitigate the risk associated with CVE-2026-20349?
To mitigate the risk of CVE-2026-20349, ensure that your Cisco devices are updated to the latest software version provided by Cisco.
Is authentication required to exploit CVE-2026-20349?
No, CVE-2026-20349 can be exploited by an unauthenticated remote attacker without the need for authentication.