Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
A high-severity vulnerability in Cisco's Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild, allowing an unauthenticated attacker to trigger a denial-of-service (DoS) condition.
## Cisco Warns of Exploited Vulnerability in ASA and FTD Software Cisco has issued a warning about a newly discovered vulnerability in its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The high-severity flaw, tracked as CVE-2026-20349, has been exploited in the wild, allowing an unauthenticated attacker to trigger a denial-of-service (DoS) condition. The vulnerability occurs when processing HTTP requests, which can lead to a reload of the affected device, resulting in a DoS condition. Cisco has confirmed that the issue was found during internal security testing and has credited Valerio Brussani for separately discovering and reporting the vulnerability. ## Affected Versions and Fixes The security defect impacts devices running a vulnerable version of Secure Firewall ASA Software or Cisco Secure FTD Software. The affected versions include: - ASA 9.161, fixed in 9.16.4.50 - ASA 9.181, fixed in 9.18.4.50 - ASA 9.20, fixed in 9.20.4.235 - ASA 9.22, fixed in 9.22.3.191 - ASA 9.23, fixed in 9.23.1.211 - ASA 9.24, fixed in 9.24.1.221 - FTD 7.0, fixed in Cisco_FTD_Hotfix_GC-7.0.9.1-1.sh.REL.tar - FTD 7.2, fixed in Cisco_FTD_Hotfix_HM-7.2.11.1-2.sh.REL.tar - FTD 7.4, fixed in Cisco_FTD_Hotfix_HK-7.4.7.1-1.sh.REL.tar - FTD 7.6, fixed in Cisco_FTD_Hotfix_DD-7.6.4.1-2.sh.REL.tar - FTD 7.7, fixed in Cisco_FTD_Hotfix_AN-7.7.11.1-2.sh.REL.tar - FTD 10.0, fixed in Cisco_FTD_Hotfix_S-10.0.0.1-2.sh.REL.tar ## CISA Adds Flaw to Known Exploited Vulnerabilities Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by August 14, 2026. There are currently no details about the nature of the attacks, the identity and origins of the threat actor exploiting the vulnerability, what organizations have been targeted, and if any of those efforts were successful.
