Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
TL;DR 📌
- Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- Highest CVSS: 8.6 (High).
- Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-20349.
What it is
CVE-2026-20349 is a heap inspection vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). The flaw sits in the code handling heap memory on affected devices.
An attacker needs no credentials and can reach the vulnerability over the network, per the CVSS vector (AV:N, PR:N, UI:N). This points to a data-plane or externally reachable process rather than a management-only interface, though the advisory should be consulted for the precise traffic or feature that triggers it.
Successful exploitation causes the device to reload, producing a denial of service. The CVSS scoring (C:N/I:N/A:H) confirms this is an availability impact only — there is no indication of data disclosure or integrity loss. The score of 8.6 (High) reflects the ease of remote, unauthenticated triggering combined with the impact of an unplanned reload on a firewall.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11, meaning it is known to be exploited.
What to do
- Treat this as a priority patching item given its KEV status and unauthenticated remote trigger on firewall infrastructure.
- Check Cisco’s advisory for fixed software releases covering your specific ASA or FTD version — none were available at the time of this brief, so consult the advisory directly for current guidance.
- Where a fix isn’t yet available for your version, review Cisco’s advisory for any interim mitigations or workarounds before assuming none exist.
- Confirm which devices in your estate run ASA or FTD and prioritise those exposed to untrusted networks.
- Once a fix is published, plan for a device reload during the maintenance window, since applying the update itself may require a restart.
- Monitor for unexpected reloads on affected devices in the meantime, as these may indicate active triggering of this condition.
For leadership 🧭
Executive summary. Risk is High (CVSS 8.6) across any Cisco kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.
Why it matters:
- Exposure depends on deployment topology and which access paths reach the affected component.
- Treat internet-facing and management-plane instances as higher risk than internal-only ones.
- Keep monitoring for abnormal authentication and configuration events until upgrades complete.
Now / Next / Later:
- Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
- Next: apply the remediation the advisory specifies, through an approved change window.
- Later: add a control check so builds cannot drift back onto a vulnerable train.