Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker can send a malicious web request to an exposed Cisco Remote Access SSL VPN service and force the firewall device to restart. This can interrupt remote access and other services handled by the device. The supplied CVSS assessment indicates availability impact, not data theft or modification.
Executive priority
Treat this as an urgent availability risk because exploitation is documented through CISA KEV and no authentication is required. Immediately identify exposed VPN gateways, confirm business-critical dependencies and resilience, then follow Cisco's current remediation guidance. Prioritize public-facing and single-device deployments where a reload would materially disrupt workforce access or network operations.
Technical view
CVE-2026-20349 affects listed Cisco ASA and FTD releases running the Remote Access SSL VPN service. Insufficient error checking while processing HTTP requests permits a remote, unauthenticated attacker to trigger an unexpected device reload. It is rated CVSS 8.6 because exploitation is network-accessible, low-complexity, and can cause high availability impact.
Likely exposure
Highest exposure exists where a listed ASA or FTD release has Remote Access SSL VPN enabled and reachable from the Internet. Devices without the service enabled or reachable are not exposed through the described attack path. The bundle lists many releases, so each deployment requires comparison with Cisco's current advisory.
Exploitation context
CISA's Known Exploited Vulnerabilities listing supports active exploitation. The supplied sources do not describe campaign scale, attacker attribution, exploitation frequency, public exploit availability, or specific indicators of compromise. The demonstrated outcome is denial of service through device reload, not disclosed code execution or data compromise.
Researcher notes
The supplied evidence supports an HTTP-processing denial of service resulting in appliance reload. It does not support claims of code execution, authentication bypass, confidentiality loss, persistence, or integrity impact. Fixed versions, workarounds, detection signatures, and exploitation telemetry are not included in the bundle and must be obtained from current vendor guidance.
Mitigation direction
- Follow Cisco's advisory for fixed releases or workarounds; this bundle does not identify them.
- Prioritize Internet-reachable Remote Access SSL VPN appliances supporting critical operations.
- Where operationally feasible, limit unnecessary SSL VPN reachability pending vendor-directed remediation.
- Review failover and outage procedures for devices that could reload unexpectedly.
Validation and detection
- Inventory ASA and FTD versions and identify devices with Remote Access SSL VPN enabled.
- Confirm whether each enabled service is reachable from the Internet or other untrusted networks.
- Compare deployed versions against Cisco's current affected and fixed-release tables.
- Review device uptime, reload history, and relevant logs for unexplained resets.
- After remediation, verify the installed release and normal VPN and failover operation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-244: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-20349 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H3.94ciscoVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-20349 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-08-11T00:00:00.000Z: CVE-2026-20349 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- cisco-sa-asaftd-vpn-dos-dzv4mQFFCVE reference, cisco
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Improper Clearing of Heap Memory Before Release ('Heap Inspection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.