Crafted HTTP request to Remote Access SSL VPN reloads Cisco ASA/FTD firewalls (CVE-2026-20349)
Cisco revised the advisory on 2026-09-16 as part of its September 16 advisory bundle after Eclypsium reported attackers crashing Cisco firewalls with this flaw in August, so teams still running unpatched ASA/FTD with SSL VPN exposed can have their edge firewall rebooted at will by anyone on the internet.
Insufficient error checking when the Remote Access SSL VPN service on Cisco Secure Firewall ASA and FTD processes HTTP requests lets an unauthenticated remote attacker send a crafted request that forces the device to reload. Each trigger drops all traffic and VPN sessions through the firewall until it comes back up, and Cisco states there are no workarounds.
Affected: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14, 9.16.3, 9.16.3.3 (and other releases listed in cisco-sa-asaftd-vpn-dos-dzv4mQFF); Cisco Secure Firewall Threat Defense (FTD) Software with the Remote Access SSL VPN service enabled
How to Test
Check the running ASA/FTD software version against the affected release list in advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF; the flaw is reachable only where the Remote Access SSL VPN service is enabled on an interface, so confirm whether that service is exposed on any internet-facing interface. For signs of attack, review the device for unexpected reloads and crash files since 2026-08-11 and correlate with inbound HTTP requests to the SSL VPN service in the same window.
How to Patch
Upgrade ASA/FTD to a fixed release for your train per Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF (Bug ID CSCwv96220, version 1.1 of 2026-09-16). Cisco states no workarounds address this vulnerability; until the upgrade is applied, the only risk reduction is restricting who can reach the Remote Access SSL VPN service.