CVE-2026-20349: Cisco Secure Firewall — Remote DoS Zero-Day (June 2026)

CVE-2026-20349 — Cisco Secure Firewall

CVE-2026-20349 is a critical vulnerability in Cisco Secure Firewall ASA and FTD devices. It allows remote, unauthenticated attackers to trigger a denial-of-service (DoS) by sending specially crafted HTTP requests to the Remote Access SSL VPN service. Cisco has confirmed active exploitation in the wild; immediate patching is required to prevent service disruption and potential follow-on attacks.

Attack Vector

Attackers exploit CVE-2026-20349 by sending malformed HTTP requests to the SSL VPN interface exposed on affected Cisco firewalls. No authentication is required. Successful exploitation causes the device to reload, resulting in loss of firewall functionality and network segmentation. This can expose internal assets to further compromise, especially if the device is internet-facing or used as a primary perimeter defense.

Who Is at Risk

All organizations running Cisco Secure Firewall ASA and FTD appliances with Remote Access SSL VPN enabled are at risk. Cisco has confirmed exploitation globally. Both on-premises and cloud-managed deployments are affected. Immediate attention is required for any environment relying on these devices for critical network security.

Patch & Mitigate

• Patch: Apply the official Cisco security updates for ASA and FTD devices released June 2026. Refer to Cisco's advisory for exact versions.
• Workaround: No official workaround is available. Restrict external access to the SSL VPN interface if patching is delayed.
• Detect: Monitor firewall logs for unexpected reload events and anomalous HTTP traffic targeting the SSL VPN service. Look for spikes in malformed or unexpected HTTP requests.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers disrupt firewall operations to bypass network security controls.
• TA0040 — Impact: The exploit directly causes denial-of-service, impacting availability of network defenses.

Source: https://www.securityweek.com/cisco-patches-firewall-zero-day-exploited-for-dos-attacks/