Cisco ASA and FTD: exploited SSL VPN DoS, hot fix only

ColCERT, Colombia’s national CSIRT, has issued alert COLCERT AL-20260819-113 on CVE-2026-20349, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD). According to the alert, Cisco has confirmed active exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on the day it was disclosed.

This article is based on a single source, the ColCERT alert, which in turn draws on Cisco’s advisory and on alert AL26-018 from the Canadian Centre for Cyber Security. Every statement below is attributed to the Colombian agency.

What is happening

According to ColCERT, a remote, unauthenticated attacker can send a single crafted HTTP request to the VPN portal and cause an unexpected reload of the firewall, with no user interaction. The attack can be repeated at will, so it can keep the device out of service for as long as the attacker wants.

ColCERT stresses the knock-on effect: when the perimeter firewall goes down, network access control and remote working for the whole organization stop at the same time. Cisco Secure Firewall Management Center (FMC) is not affected.

Technical details

• CVE: CVE-2026-20349; Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF.
• CVSS score: 8.6 (high). The vector shows no impact on confidentiality or integrity (C:N, I:N), high impact on availability (A:H) and a changed scope (S:C).
• Weakness: CWE-244, Improper Clearing of Heap Memory Before Release (“heap inspection”).
• Conditions: a device is vulnerable only if it runs an affected release and has at least one feature enabled that opens listening SSL sockets. The alert notes that the risk is highest when the VPN portal is reachable from the internet, which is the normal setup for remote access. The exact list of releases and features is in Cisco’s advisory.

ColCERT makes two points about severity. First, according to Cisco this is not remote code execution: there is no data exposure and no evidence that the attacker can take administrative control of the device. Second, the weakness assigned, as MITRE defines it, concerns information exposure in heap memory, and the underlying flaw is a heap management problem reachable without authentication through the HTTP engine of the VPN portal. Since similar flaws in this component have in the past been taken to more serious scenarios, ColCERT recommends treating it with the same urgency as an RCE on a perimeter device. This is a precautionary assessment by the agency, not a fact reported by Cisco.

In MITRE ATT&CK terms, the exploitation described falls under T1499.004 (Endpoint Denial of Service: Application or System Exploitation).

No workaround: hot fix only

According to the alert, Cisco has confirmed that there are no workarounds and no compensating configurations. The fix is delivered only as a hot fix through the Software Center: it is not part of a regular general availability release, so a routine upgrade within the software train is not enough.

ColCERT highlights a few practical details:

• hot fixes for ASA 9.16 and 9.18 have version numbers starting with 89 (this is not a typo);
• these hot fixes must be installed together with ASDM 7.24.1.374: earlier versions do not recognize the numbering, and you lose access to the management console;
• for FTD, each train has platform-specific variants (SSP, FP1K, FP2K, FP3K, Secure Firewall 1200/4200/6100): install the exact one for your hardware, never generic packages.

As temporary measures, the alert mentions restricting the VPN portal with ACLs on source addresses, which reduces the attack surface but does not protect against anyone who can still reach the service, and disabling the VPN, which removes the exposure but stops remote working. ColCERT sees the latter as a business continuity decision, to be escalated to management and documented.

Impact for European and Italian companies

The alert is Colombian, but the vulnerability affects anyone using ASA or FTD as a perimeter firewall or VPN concentrator, in Europe as elsewhere. As ColCERT describes, a repeated attack can leave a company without remote access and with its perimeter down, and it requires no credentials.

For entities in scope of NIS2, the case concerns the handling of exploited vulnerabilities, with documented priorities and timelines, and business continuity. A significant disruption caused by an attack should be assessed for notification to CSIRT Italia at ACN (or the national CSIRT in other member states). In healthcare, where the VPN often connects doctors, suppliers and remote sites, a firewall that keeps reloading means clinical services that cannot be reached.

What to do now

1. Take inventory of all ASA and FTD devices, flagging those with the SSL VPN portal exposed to the internet (ColCERT points to the first 24 hours).
2. Check release and enabled features. The commands suggested in the alert: show version | include Version, show running-config webvpn, show running-config crypto ikev2, show running-config zero-trust (FTD only) and show asp table socket | include SSL. Confirm the result with Cisco Software Checker.
3. Install the right hot fix for your release and platform, starting with internet-facing devices; ColCERT sets a deadline of 72 hours at most. Plan for reload time in the maintenance window.
4. Look for signs of exploitation. Cisco has not released atomic indicators of compromise (hashes, IPs, domains), so hunting is behavioral: reloads with no configuration change or power failure, repeated reloads on the same device, many VPN sessions dropping at once in syslog, spikes of anomalous HTTP requests to port 443 on the outside interface from a few sources. ColCERT suggests reviewing the last 30 days of logs.
5. Preserve the crashinfo file before any manual reload or upgrade: according to ColCERT it is the only forensic evidence of the event, and it gets overwritten.
6. If you use Snort or FirePOWER, make sure rules 46897 and 59654 are enabled: they are a partial control and do not replace the hot fix.
7. If you find traces of exploitation, handle the event as a security incident, not just as a vulnerability.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet and which have known vulnerabilities, so you know whether a VPN portal can be reached from outside. ARX Sentry collects firewall logs in a central collector, and the NOC map highlights VPN errors: reloads and sudden session drops become easier to spot and to reconstruct.

Last updated: 9 October 2026