Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
NVD: A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Hunt for unauthenticated crafted HTTP requests sent to the Remote Access SSL VPN listener on Cisco ASA and FTD devices that correlate with unexpected device reloads and loss of VPN connectivity.
Research details
ComponentRemote Access SSL VPN service (HTTP request processing)
PreconditionsNetwork reachability to the Remote Access SSL VPN service on affected Cisco ASA (9.16-9.24) or FTD (7.0-10.0) releases with SSL VPN, IKEv2 Remote Access VPN client services, or ZTNA enabled; no authentication or user interaction required; a single crafted HTTP request triggers an unexpected device reload. agent
Deliverycrafted HTTP request to the Remote Access SSL VPN service
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.6) | Actively exploited in the wild per Cisco PSIRT (Aug 2026); no workaround, hotfixes only for ASA 9.16-9.24 and FTD 7.0-10.0; FMC not affected
SummaryCisco Secure Firewall ASA/FTD Remote Access SSL VPN service heap inspection flaw lets an unauthenticated attacker reload the device with a crafted HTTP request, causing DoS. Actively exploited (Cisco PSIRT aware since Aug 2026) with no workaround; hotfixes exist for ASA 9.16-9.24 and FTD 7.0-10.0. No public PoC identified in this cycle.
Tia coverage
First reported2026-08-11
First exploit report2026-08-11
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.