Heap Inspection in Cisco Firewall Threat Defense (FTD) and Cisco Adaptive Security Appliance (ASA) - CVE-2026-20349
Published: August 12, 2026
Vulnerability identifier: #VU141542
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20349
CWE-ID: CWE-244
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to insufficient error checking in the Remote Access SSL VPN service when processing HTTP requests. A remote attacker can send a crafted HTTP request to cause a denial of service.
The issue can cause the affected device to reload unexpectedly.
Note, the vulnerability is being exploited in the wild.
Affected software
Cisco Firewall Threat Defense (FTD)
Cisco Adaptive Security Appliance (ASA)
Cisco Adaptive Security Appliance (ASA)
How to mitigate CVE-2026-20349
Install security update from vendor's website.
Cisco Firewall Threat Defense (FTD) - addressed in versions 7.0.9.1-1, 7.2.11.1-2, 7.4.7.1-1, 7.6.4.1-2, 7.7.11.1-2, 10.0.0.1-2
Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.16 89.18.4.50, 9.18 89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221
Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.16 89.18.4.50, 9.18 89.18.4.50, 9.20.4.235, 9.22.3.191, 9.23.1.211, 9.24.1.221