Cisco Patches Firewall Zero-Day Exploited for DoS Attacks
Vulnerabilities
CVE-2026-20349 can be exploited remotely without authentication against Secure Firewall ASA and FTD devices.
Cisco informed customers on Tuesday that it has released patches for a zero-day vulnerability affecting firewalls running Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software.
The security hole, tracked as CVE-2026-20349, is related to the processing of HTTP requests.
A remote, unauthenticated attacker can cause the appliance to reload and enter a denial-of-service (DoS) condition by sending a specially crafted HTTP request to the Remote Access SSL VPN service.
The vulnerability was discovered internally by Cisco and also reported by an external researcher.
Cisco said it became aware of active exploitation in August 2026, but has not shared any information on the attacks involving CVE-2026-20349.
These types of vulnerabilities could allow threat actors to disrupt security appliances, potentially preventing them from detecting and blocking further malicious activity.
Advertisement. Scroll...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
