Cisco has patched a critical vulnerability in the SSL VPN service of Secure Firewall ASA and FTD that allows unauthenticated attackers to force a device reboot. The vulnerability, with a CVSS score of 8.6, is already being actively exploited.
The vulnerability CVE-2026-20349 affects the SSL VPN service of Cisco Secure Firewall ASA (Adaptive Security Appliance) and FTD (Firepower Threat Defense). Attackers can trigger a denial-of-service condition without authentication, forcing the affected devices into an uncontrolled reboot. Cisco has rated the flaw with a CVSS score of 8.6 and classifies it as critical.
Of particular relevance to CISOs is the fact that, according to Cisco, the vulnerability is already being actively exploited. ASA and FTD devices are used by many organizations as central perimeter firewalls and VPN gateways, making them directly reachable from the internet. A successful attack results in an outage of the VPN service and can potentially cause disruptions to remote access as well as availability issues for dependent business processes.
Cisco has released patches to address the vulnerability. Affected organizations should apply the available security updates for ASA and FTD immediately, especially if the SSL VPN service is actively in use and the devices are reachable from the internet. Until the patches are applied, it is advisable to check whether access to the SSL VPN service can be temporarily restricted, and to increase monitoring of the affected systems for signs of unusual reboots or availability disruptions.
Cisco is patching the critical, already actively exploited SSL VPN vulnerability CVE-2026-20349 (CVSS 8.6) in ASA and FTD, which unauthenticated attackers can use to force device reboots.
Source: www.security-insider.de · Published August 13, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.