Reported by 6 outlets
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.41 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The assigned story centers on CVE-2026-20349, a high-severity denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD software with a CVSS 3.1 score of 8.6. The flaw resides in the Remote Access SSL VPN service and is caused by insufficient error checking when processing HTTP requests; a single crafted HTTP request sent to the SSL listen socket can force the device to reload unexpectedly, producing an unauthenticated remote denial of service. The vulnerability affects configurations that enable SSL listen sockets, specifically IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices. Secure Firewall Management Center software is not affected. The events also reference CVE-2026-20079, a separate CVSS 10.0 authentication bypass in Cisco FMC that threat intelligence links to the same actor clusters, reinforcing that the firewall management plane is under coordinated pressure.
A successful exploit does not steal data but severs connectivity. Because the CVSS scope-change flag is set, crashing the firewall interrupts every VPN session and network path the device manages, making the impact organizational rather than limited to the appliance. The story carries particular weight because Cisco PSIRT confirmed active exploitation in August 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 11, 2026, and ordered U.S. federal civilian agencies to remediate by August 14, 2026. No workarounds exist, which eliminates any temporary mitigation strategy and forces an immediate upgrade decision. The related threat intelligence mentions ransomware actors and state-sponsored clusters exploiting these Cisco firewall weaknesses simultaneously, which means defenders should treat patching as urgent rather than routine.
Defenders must upgrade to the fixed releases: ASA 9.16.4.103, 9.18.4.94, 9.20.4.49, 9.22.3.26, 9.23.1.47, 9.24.1.26; FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0. Cisco previously issued hot fixes but now recommends the hardening releases published on September 16, 2026. For hunting, inspect device logs for unexpected reload events tied to Remote Access SSL VPN traffic, review Snort rules 46897 and 59654 for relevant signatures, and verify whether SSL listen sockets are exposed externally via show running-config for webvpn or crypto ikev2 enable entries. If exposure is confirmed and patching is delayed, restrict network access to the SSL VPN interfaces at the perimeter firewall or upstream router, though this only reduces reachability and does not eliminate the vulnerability.
Two developments would alter this assessment: confirmation of specific actor attribution beyond the current references to ransomware and state-sponsored clusters, and telemetry showing exploitation expanding beyond DoS into chaining with the CVE-2026-20079 FMC authentication bypass, which would shift the risk profile from service interruption to full management-plane compromise.
Timeline
-
original reporting
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks
securityweek.com · 63d ago · August 12th, 2026
-
original reporting
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why
malware.news · 55d ago · August 19th, 2026
An unauthenticated attacker can crash any Cisco ASA or FTD with SSL VPN exposed; it’s been confirmed exploited in the wild, and Cisco hasn’t told us who or why. Attackers Can Force Your Firewall To Reboot If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349 . On August 11, 2026, Cisco published an advisory , scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. Cisco describes the vulnerability as “insufficient error checking when processing HTTP requests,” which allows an unauthenticated remote attacker to send a crafted HTTP request and trigger an unexpected device reboot. The entire attack can be executed in one packet and requires no credentials or user interaction. The CVSS vector indicates how easy this vulnerability is to exploit: network-reachable, low complexity, no privileges, no user interaction required. The scope change flag is set because crashing the ASA does not just affect the firewall itself; it cuts off every session the device is managing. No workarounds exist, so patching is the only fix. CIS
-
update from bleepingcomputer.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices
bleepingcomputer.com · 63d ago · August 11th, 2026
Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. "A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition." The vulnerability can be exploited remotely without authentication or user interaction when SSL listen sockets are enabled. Vulnerable configurations include IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices. Cisco says Secure Firewall Management Center (FMC) software is not affected. Cisco has released hot fixes for affected ASA 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24 releases, as well as FTD releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. There are no workarounds for the vulnerability, and Cisco strongly recommends that customers upgrade to a fixed sof
-
update from socprime.com
CVE-2026-20349: Actively Exploited Cisco ASA and FTD Flaw Enables Remote DoS
socprime.com · 62d ago · August 12th, 2026
No authentication or user interaction is required, making internet-facing VPN gateways particularly attractive targets for disruption. The vulnerability impacting Secure Firewall Adaptive Security Appliance and FTD products becomes exploitable when specific remote-access functionality enables SSL listen sockets. A successful attack can abruptly restart the affected security appliance, interrupting VPN connectivity and potentially disrupting access to business-critical networks and services. Cisco’s Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026. Following confirmation of attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered U.S. federal civilian agencies to remediate it by August 14, 2026.
-
update from malware.news
Cisco security advisory (AV26-807)
malware.news · 62d ago · August 12th, 2026
Serial number: AV26-807 Date: August 12, 2026 As of August 11, 2026, Cisco is affected by a vulnerability in the following products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software multiple versions Cisco Secure Firewall Threat Defense (FTD) Software multiple versions The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from thehackernews.com
🤖 Cisco FMC auth bypass (CVE-2026-20079, CVSS 10.0) actively exploited: three threat clusters — ransomware and state-sponsored — steal crede
thehackernews.com · 32d ago · September 11th, 2026
🤖 Cisco FMC auth bypass (CVE-2026-20079, CVSS 10.0) actively exploited: three threat clusters — ransomware and state-sponsored — steal crede
via Mastodon https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html
-
update from cyber.netsecops.io
📰 Cisco Firewall Flaws Actively Exploited by Ransomware & State Actors Cisco warns multiple threat groups, including Qilin ransomware and st
cyber.netsecops.io · 31d ago · September 12th, 2026
📰 Cisco Firewall Flaws Actively Exploited by Ransomware & State Actors Cisco warns multiple threat groups, including Qilin ransomware and st
via Mastodon https://cyber.netsecops.io/articles/cisco-firewall-flaws-exploited-by-ransomware-and-state-actors/?utm_source=mastodon&utm_medium=social&utm_campaign=daily