SecurityOnlineDo Son
Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349
Part of the CVE-2026-20349 story · since 11 Aug
Quiet for 12 dayslast report 29 Oct8 articles4 outlets
- Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
- Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
- Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV. This article, 3rd of 8.
- Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
- Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
- Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV.
- Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
- Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
A critical vulnerability in Cisco's Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) has been identified, tracked as CVE-2026-20349. This flaw allows unauthenticated attackers to remotely crash the firewall, designated with a CVSS score of 8.6 (High). The vulnerability affects multiple versions of the ASA and FTD software and is already being actively exploited. Cisco recommends urgent upgrading to fixed releases, as no workarounds are available. The flaw arises from weak input validation in the Remote Access SSL VPN service, enabling denial of service conditions.
How the story developed
Quiet for 12 dayslast report 29 Oct8 articles4 outlets
8 articles from 4 outlets since 11 Aug. Quiet since 29 Oct. This was the 3rd report, 4 hours after the first.
- Tue 11 Aug, 22:35 UTC. CISA, first report. Cisco ASA/FTD heap bug lets remote attackers crash firewalls. Cites a CVE in CISA KEV.
- Wed 12 Aug, 00:17 UTC. CISA. CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog. Cites a CVE in CISA KEV.
- Wed 12 Aug, 02:32 UTC. SecurityOnline, its first report on the story. Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-20349. Cites a CVE in CISA KEV. This article, 3rd of 8.
- Wed 12 Aug, 05:20 UTC. SecurityWeek, its first report on the story. Cisco patches critical ASA/FTD zero day as attacks spike. Cites a CVE in CISA KEV.
- Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
- Thu 13 Aug, 17:21 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall. Cites a CVE in CISA KEV.
- Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
- Thu 29 Oct, 10:30 UTC. SecurityWeek. Cisco fixes exploited VPN flaw that can crash firewalls. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 8 articles as a listHide the list
- Tue 11 AugDay 01
- Cisco ASA/FTD heap bug lets remote attackers crash firewalls22:35 · CISA · official · First report · CISA alert · Known exploited CVE
- Wed 12 AugDay 14
- CISA adds Cisco firewall heap flaw CVE-2026-20349 to KEV catalog00:17 · CISA · official · Known exploited CVE
- Cisco ASA/FTD flaw lets attackers crash firewalls, CVE-2026-2034902:32 · SecurityOnline · Known exploited CVE · This article, 3rd of 8
- CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
- Thu 13 AugDay 21
- CISA Flags Critical Flaws in Metabase, Windows and Cisco Firewall17:21 · Security Affairs · Known exploited CVE
Quiet for 3 days
Mon 17 AugDay 61- Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 10 weeks
Thu 29 OctDay 791- Cisco fixes exploited VPN flaw that can crash firewalls10:30 · SecurityWeek · Picked up again · Known exploited CVE