Emerging ThreatsMalware & Ransomware

Cisco Warns of Active Exploitation of VPN Flaw in ASA, FTD Software

Analyst 207||Source: BleepingComputer
Cisco security appliance on a rack surrounded by networking equipment indoors.

"An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device," Cisco explains in the advisory.

CVE-2026-20349: the technical failure and immediate effect

Cisco says CVE-2026-20349 is a high-severity denial-of-service vulnerability (CVSS 8.6) caused by insufficient error checking while processing HTTP requests. A successful exploit, Cisco warns, can force an affected Secure Firewall Adaptive Security Appliance (ASA) or Secure Firewall Threat Defense (FTD) device to reload, producing a DoS condition that disrupts the appliance's operation.

The vendor specifies that the vulnerability can be triggered remotely without authentication or user interaction when SSL listen sockets are enabled, and that the attack vector is a "crafted HTTP request" sent to the Remote Access SSL VPN service on the affected device.

Affected Cisco Secure Firewall ASA and FTD configurations

  • The products and features Cisco names as vulnerable include ASA and FTD devices when certain remote access services are enabled: IKEv2 Remote Access VPN with client services, SSL VPN, and Zero Trust Network Access on FTD devices.
  • Cisco also states Secure Firewall Management Center (FMC) software is not affected by this vulnerability.

Cisco's fixes, guidance, and what is not available

Cisco has released hot fixes for impacted releases. The fixed ASA releases are 9.16, 9.18, 9.20, 9.22, 9.23, and 9.24. The fixed FTD releases are 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. In its advisory the company says there are no workarounds for the vulnerability and "strongly recommends that customers upgrade to a fixed software release to fully remediate the issue."

The advisory does not supply indicators of compromise (IOCs) associated with the active exploitation Cisco reports, leaving the published fixes as the only vendor-provided remediation path in the notice.

Active exploitation, discovery, and unanswered attribution

Cisco's Product Security Incident Response Team (PSIRT) says it became aware of active exploitation of CVE-2026-20349 in August 2026. Beyond confirming active exploitation, the company has not shared details about the attacks — including who is exploiting the flaw or what organizations are being targeted.

The vulnerability was found both during Cisco's internal security testing and via an independent report from researcher Valerio Brussani, Cisco says. The advisory likewise does not provide forensic indicators tied to the ongoing exploitation.

How technologists and procurement leaders are affected

  • Technologists and security teams: Cisco "strongly recommends" upgrading to fixed releases because no workarounds exist; the advisory's lack of IOCs and Cisco's limited disclosure on active exploitation will increase reliance on patching as the primary defense.
  • Procurement and affected enterprises: organizations that operate ASA or FTD appliances with the named remote access services enabled will need to coordinate timely installs of the specified hot fixes for ASA releases 9.16–9.24 and FTD releases 7.0–10.0 to fully remediate the issue.

Cisco also disclosed this month that Secure Endpoint Connector for Windows, Mac, and Linux is vulnerable to ClamAV vulnerabilities with public exploits; in that case Cisco says patches are not available yet but "will be released later this month." That second disclosure, paired with the ASA/FTD advisory, highlights concurrent remediation tasks in Cisco's product portfolio.

One empirical reminder from the company's broader reporting appears in the same source: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 cited there measures defenses technique by technique across 338 million simulations run in customer production environments — a data point the advisory includes as context.

Two facts stand out from Cisco's bulletin: a high-severity VPN-facing flaw (CVE-2026-20349) is being actively exploited, and the vendor's published fixes plus the recommendation to upgrade are the only complete mitigations the advisory lists, because no workarounds or IOCs are provided. For defenders, the immediate task is clear in Cisco's terms — apply the hot fixes for the listed ASA and FTD releases — even as questions about who is exploiting the vulnerability and which organizations are affected remain unanswered.

Original Cisco advisory summary at BleepingComputer

CiscoEmerging ThreatsNetwork SecurityRemote AccessDenial Of ServiceASAFTDVPN FlawSSL VPNCVE-2026-20349
Related Intelligence

Continue Reading

Technicians work in a network operations center with rows of computer servers and networking equipment.

Kimwolf Botnet Evolves to Evade DDoS Detection

The Kimwolf botnet has levelled up its game with a new upgrade, v7, which uses HTTP/2 floods to mimic real browser traffic, making it super tricky to detect as a DDoS attack. This sneaky move lets the botnet build complete browser fingerprints, blurring the line between legit and malicious traffic.

Analyst 207
Windows computer workstation on a clean office desk with a blank laptop screen.

Microsoft Patches Zero-Day Windows Driver Flaw Under Active Attack

Microsoft just patched a high-severity Windows driver flaw, known as CVE-2026-68820, that was already being exploited by hackers in the wild. This zero-day vulnerability, with a CVSS score of 7.0, could be triggered by a race condition, allowing attackers to gain a foothold in targeted systems.

Analyst 207
A laptop sits alone on a table in front of a blurred background of computer workstations and servers.

CAV3RN Espionage Framework Evolves With Google Apps Script C2 Relay

Meet the sneaky CAV3RN Espionage Framework, which just got a clever upgrade - it can now use Google Apps Script as a relay to secretly communicate with its controllers, all while hiding in plain sight within DNS traffic. This clever tactic lets the malware decide on a per-transaction basis whether to connect directly to its masters or take a detour through Google's services.

Analyst 207
Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore Malware

Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore Malware

In a sneaky move, the Head Mare group exploited unpatched TrueConf servers to spread PhantomCore malware, using a chain of vulnerabilities to swap out legitimate client installers with infected ones. This allowed them to secretly deliver a backdoor to unsuspecting meeting participants.

Analyst 207