{"id":"CVE-2026-20349","kind":"vulnerability","aliases":["CVE-2026-20349"],"related":[],"title":"cisco adaptive security appliance software: A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA)…","description":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"A heap inspection flaw in Cisco ASA and Secure Firewall Threat Defense lets an unauthenticated remote attacker force the device to reload unexpectedly. The result is a denial of service on the firewall, and CISA lists it as known exploited.","severity":"high","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2026-08-11T00:00:00+00:00","products":[{"name":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.1","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.1.28","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2.3","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2.7","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2.11","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2.13","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.2.14","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3.3","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3.14","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3.15","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3.19","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.3.23","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.9","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.14","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.19","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.27","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.38","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.39","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.42","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.48","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.55","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.57","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.61","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.62","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.67","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.70","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.71","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.76","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.82","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.84","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.85","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.89","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.16.4.92","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.18.1","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.18.1.3","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.18.2","ecosystem":"vendor"},{"name":"cisco adaptive security appliance software","fixed":[],"affected":"= 9.18.2.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asa","cisco","exploited","firewall","ftd","infrastructure","self-hosted"],"not_affected_if":["no-asa-or-ftd-deployed"],"how_to_check":"Check the ASA or FTD software version against the Cisco advisory for CVE-2026-20349 (affected and fixed versions not given in the sources).\nReview device logs for unexpected reloads.","fix":"Apply the Cisco fixed software release for CVE-2026-20349 and follow the mitigations in the Cisco advisory (version not given in the sources).\nIf no mitigation exists, follow CISA BOD 26-04 guidance or discontinue use of the product.","status":"open","published_at":"2026-08-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:58+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:31:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco fixed software release for CVE-2026-20349 and follow the mitigations in the Cisco advisory (version not given in the sources).\nIf no mitigation exists, follow CISA BOD 26-04 guidance or discontinue use of the product.","summary":"A heap inspection flaw in Cisco ASA and Secure Firewall Threat Defense lets an unauthenticated remote attacker force the device to reload unexpectedly. The result is a denial of service on the firewall, and CISA lists it as known exploited.","category":"infrastructure","who_cares":["cisco","asa","ftd","firewall","self-hosted"],"confidence":0.6,"analyst_note":"Find the Cisco advisory for CVE-2026-20349 to get affected and fixed versions and the specific mitigations; the sources only give the CISA KEV entry.","how_to_check":"Check the ASA or FTD software version against the Cisco advisory for CVE-2026-20349 (affected and fixed versions not given in the sources).\nReview device logs for unexpected reloads.","needs_analyst":true,"not_affected_if":["no-asa-or-ftd-deployed"],"severity_if_unknown":"high"},"cost_usd":0.000444,"input_tokens":2359,"output_tokens":416,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':348C,374C,405C '-2026':24A,27A '-20349':25A,28A '26':347C,373C,404C 'access':11A 'accord':337C 'action':333C 'adapt':2A,19A,294C 'adaptive':32A,43A,48A,53A,58A,63A,68A,73A,78A,83A,88A,93A,98A,103A,108A,113A,118A,123A,128A,133A,138A,143A,148A,153A,158A,163A,168A,173A,178A,183A,188A,193A,198A,203A,208A,213A,218A,223A,228A,233A,238A 'adher':401C 'allow':311C 'and':36A 'appli':334C 'applianc':4A,21A,296C 'appliance':34A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A,115A,120A,125A,130A,135A,140A,145A,150A,155A,160A,165A,170A,175A,180A,185A,190A,195A,200A,205A,210A,215A,220A,225A,230A,235A,240A 'applic':371C 'asa':22A,35A,242B,257B,297C 'asset':395C 'attack':267B,315C 'base':352C 'bod':346C,372C,403C 'caus':317C 'cisa':285B,331C,344C,361C 'cisco':1A,16A,29A,42A,47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,117A,122A,127A,132A,137A,142A,147A,152A,157A,162A,167A,172A,177A,182A,187A,192A,197A,202A,207A,212A,217A,222A,227A,232A,237A,243B,256B,291C 'cloud':377C 'complianc':342C 'condit':330C 'contain':304C 'could':310C 'cve':23A,26A 'defens':262B,302C 'defense':40A 'denial':278B,326C 'devic':270B,319C 'discontinu':380C 'dos':329C 'ensur':341C,400C 'evalu':393C 'exploit':244B,290B 'exposur':398C 'firewal':18A,245B,260B,283B,293C,300C 'firewall':31A,38A 'flaw':254B 'follow':370C 'forc':268B 'forens':363C 'ftd':41A,246B,303C 'guidanc':359C,375C 'guidelin':407C 'heap':252B,306C 'host':250B 'infrastructur':247B 'inspect':253B,307C 'instruct':340C 'internet':397C 'known':289B 'let':263B 'list':286B 'mitig':335C,386C 'note':358C,369C 'patch':406C 'priorit':349C 'product':384C 'reload':272B,321C 'remot':10A,266B,314C 'requir':332C,365C 'respons':391C 'result':275B,323C 'risk':354C 'secur':3A,17A,20A,259B,292C,295C,299C,350C 'secure':30A,37A 'security':33A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,119A,124A,129A,134A,139A,144A,149A,154A,159A,164A,169A,174A,179A,184A,189A,194A,199A,204A,209A,214A,219A,224A,229A,234A,239A 'see':355C,366C 'self':249B 'self-host':248B 'servic':14A,280B,328C,378C 'softwar':5A 'software':46A,51A,56A,61A,66A,71A,76A,81A,86A,91A,96A,101A,106A,111A,116A,121A,126A,131A,136A,141A,146A,151A,156A,161A,166A,171A,176A,181A,186A,191A,196A,201A,206A,211A,216A,221A,226A,231A,236A,241A 'ssl':12A 'stakehold':389C 'threat':39A,261B,301C 'triag':364C 'unauthent':265B,313C 'unavail':388C 'unexpect':273B,322C 'updat':351C 'url':356C,367C 'use':381C 'vendor':339C 'vpn':13A 'vulner':7A,308C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-11T00:00:00+00:00","kev":{"dateAdded":"2026-08-11","dueDate":"2026-08-14","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20349","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20349","severity":null,"published_at":"2026-08-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20349","severity":null,"published_at":"2026-08-11T17:17:48+00:00","modified_at":"2026-09-16T21:17:12+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}