Is CVE-2026-20349 being actively exploited?

Yes. CVE-2026-20349 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on August 11, 2026.

What is the CVSS score for CVE-2026-20349?

CVE-2026-20349 has a CVSS 3.1 base score of 8.6 (HIGH).

CVE-2026-20349

HIGH · CVSS 8.6CISA KEV: actively exploitedEPSS 1.0%EU EUVD: exploited

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Key facts

CVSS score: 8.6 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness (CWE): CWE-244
EPSS score: 1.0% (62th percentile)
In CISA KEV: Yes, added August 11, 2026
In EU EUVD: Yes (EUVD-2026-56643)
Published: August 11, 2026
NVD last modified: September 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Added to the KEV catalog on August 11, 2026; federal remediation due August 14, 2026.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-56643 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on September 16, 2026.

View on the EU Vulnerability Database

Affected products

cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software
cisco / adaptive security appliance software

and 147 more…

Certified products that may be affected

2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Secure Firewall Threat Defense (FTD) 7.4 with Secure Firewall Management Center (FMC) 7.4 and Secure Client 5.1 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400046-01-CR - active
Cisco Secure Firewall Threat Defense Virtual 7.4 with FMC/FMCv - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11510-2025 - active

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349(US Government Resource)

Last updated September 18, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain