← All Advisories

Cisco Secure Firewall ASA and FTD's Heap Inspection Vulnerability Allows Remote Attackers to Extract Sensitive Memory Contents from the Firewall Device; CISA's August 14th KEV Deadline Has Passed

Last refreshed2026-09-27

Status: KEV  |  Advisory ID: CVE-2026-20349

Key Details

CVECVE-2026-20349
Vulnerability NameCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
CVSS Score / Version8.6 (High) / CVSS v3.1
Updated2026-09-20
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected productsCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) , Cisco Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense
Exploitation statusListed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation.
Classified asCWE-244 (Improper Clearing of Heap Memory Before Release ('Heap Inspection'))
KEV listingAdded to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11.
Exploitation prediction (EPSS)1.01% probability of exploitation in the next 30 days (62% percentile) -- FIRST.org's EPSS model.
Federal remediation deadline2026-08-14 (CISA KEV, Binding Operational Directive).

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
CiscoSecure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
CiscoAdaptive Security Appliance (ASA) Software
CiscoSecure Firewall Threat Defense
SubsystemsIndustrial Network - Routers/Firewalls
SectorsCritical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems

What to Know

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

What to Do

Monitor Cisco's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-20349
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-20349

KEV Required Action

FieldValue
KEV Linkhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
Date Added to KEV2026-08-11
Required Action Due Date2026-08-14
Required ActionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE