EUVD-2026-56643
GHSA-8x4j-5v9x-9frv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing ASA/FTD device with SSL VPN enabled on TCP/443
-
DeliveryCraft malformed HTTP request targeting VPN service
-
ExploitSend request with no authentication or session required
-
ExecutionTrigger heap memory error in HTTP parser
-
PersistDevice initiates unexpected reload
-
ImpactFirewall unavailable, all traffic and VPN sessions dropped
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Improper clearing of heap data
|
| Exploitation Conditions | The Remote Access SSL VPN service must be enabled and reachable on the affected Cisco ASA or FTD device - this is the typical production configuration for any organization using Cisco AnyConnect or clientless VPN, meaning the service is commonly internet-facing on TCP/443. No authentication is required and no VPN user accounts or tunnel configuration is needed by the attacker - the vulnerability is triggered at the HTTP parsing layer before any session establishment. The CVSS vector PR:N/AC:L/UI:N confirms no privileges, low complexity, and no user interaction are required. Exploitation is not limited to a specific platform within the affected range: all enumerated ASA 9.16.x-9.24.x and FTD 7.0.x-10.0.x versions are vulnerable per EUVD. The only factor limiting exposure is whether the SSL VPN interface is accessible from the attacker's network - organizations that have not restricted VPN portal access to known source IPs are fully exposed. |
| Impact | Real-world risk is severe. The CVSS base score of 8.6 with AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H captures the worst-case deployment scenario: a firewall with Remote Access SSL VPN exposed to the internet can be taken offline by any unauthenticated attacker sending a single crafted HTTP request. CISA KEV confirms active exploitation, which is the strongest real-world risk signal available. SSVC lists Exploitation as 'none,' which directly contradicts the KEV listing - this discrepancy is notable and likely reflects a stale SSVC assessment predating the KEV addition; defenders should treat the KEV status as authoritative. SSVC does mark this as Automatable (yes), meaning exploit delivery can be scripted and scaled, and Technical Impact is assessed as partial (availability only, not full compromise). The combination of no authentication requirement, low attack complexity, automatable exploitation, and confirmed active exploitation makes this a critical-priority patch regardless of the CVSS score. The only limiting factor from a severity standpoint is that the impact is purely availability - there is no confidentiality or integrity exposure, so successful exploitation cannot directly lead to data theft or lateral movement. |
| Exploit ScenarioDerived | An attacker with no credentials and no prior knowledge of the target's internal configuration sends a single crafted HTTP request to the device's public-facing SSL VPN interface (typically TCP/443). The malformed input triggers the insufficient error-handling path in the heap memory processing layer, causing the ASA or FTD process to fault and the device to initiate an unexpected reload. The firewall is unavailable for the duration of the reload cycle (typically several minutes), dropping all active VPN sessions, routing adjacencies, and stateful inspection for all traffic, achieving denial of service for all device-dependent network paths. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and FTD Software across a broad range of versions, enabling unauthenticated remote attackers to force an unexpected device reload and take down the firewall entirely. The Changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the VPN process itself to the entire device, disrupting all traffic passing through it. This vulnerability is confirmed actively exploited (CISA KEV), with SSVC marking it as automatable, making it a high-priority remediation target for any organization with internet-exposed ASA or FTD VPN endpoints.
RemediationAI
Consult and apply the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF, which provides the definitive list of fixed software versions for both ASA and FTD trains. No specific fixed version numbers are confirmed in the available input data, so do not upgrade blindly - verify the target version against the advisory's fixed release table. As an immediate compensating control where patching is not immediately possible, consider restricting access to the SSL VPN interface (port 443) to known source IP ranges via upstream ACLs or a perimeter firewall, accepting the trade-off of reduced VPN accessibility for remote users. If the Remote Access SSL VPN feature is not in use, disabling it entirely on affected devices eliminates the attack surface. Note that disabling Remote Access VPN will break AnyConnect/Secure Client connectivity for all remote users. Given confirmed active exploitation, treat patching as urgent and do not rely solely on compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-244 (Improper Clearing of Heap Memory Before Release), manifesting in the HTTP request processing pipeline of the Remote Access SSL VPN service on Cisco ASA and FTD platforms. The SSL VPN service parses incoming HTTP requests to support clientless VPN, AnyConnect, and similar remote access functions - a component typically exposed directly to the internet on port 443. Insufficient error checking means that malformed or unexpected HTTP input can trigger an unhandled condition in the heap memory management layer, causing the process to fault and the device to issue a full reload. The Changed scope in CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H is significant: the crash is not contained to the VPN process but brings down the entire Cisco ASA/FTD appliance. Affected CPEs span ASA Software 9.16.x through 9.24.x and FTD Software 7.0.x through 10.0.x, as confirmed by EUVD-2026-56643.
Know when Secure Firewall Threat Defense gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Network-reachable VPN service requires no privileges or interaction; scope changes because the entire device reloads, not just the VPN process.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Executive ViewAI
Cisco ASA and FTD firewalls running internet-exposed SSL VPN services are currently under active attack due to CVE-2026-20349, an unauthenticated remote denial-of-service vulnerability that crashes the entire device. Organizations using these products face immediate operational risk: a single malicious HTTP request can take down their primary network security perimeter, disrupting all business traffic. With no vendor patch available and exploitation confirmed in the wild, this requires urgent remediation action.
Implement network segmentation and ACL-based access control to restrict SSL VPN endpoint exposure; deploy HTTP request filtering at the edge (WAF or reverse proxy) to block malformed requests; enable comprehensive logging and alerting on VPN service restarts or crashes to detect active exploitation attempts.
Threat Model
5 threats: Denial of Service, Elevation of Privilege, Tampering and 2 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete
Improper error checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger
Improper range checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger
Denial of service in Cisco Secure Firewall Threat Defense via crafted SSL packets allows unauthenticated remote attacker
Cisco Secure Firewall Threat Defense (FTD) Software is vulnerable to denial of service through improper TLS protocol imp
Snort 3 Detection Engine in multiple Cisco products can be remotely restarted by unauthenticated attackers through craft
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Applian
Snort 3 detection engine contains a vulnerability that allows attackers to cause a DoS condition when the Snort 3 Detect
Snort 3 Detection Engine contains a vulnerability that allows attackers to cause a denial of service (DoS) condition whe
Snort rule bypass in Cisco Secure Firewall Threat Defense allows unauthenticated remote attackers to evade deep packet i
Exploit-DB