Full Report
Cisco security advisory (AV26-807)
Analysis Summary
# Vulnerability: Cisco ASA and FTD Remote Access SSL VPN Denial of Service
## CVE Details
- **CVE ID:** CVE-2026-20349
- **CVSS Score:** 8.6 (High) - *Estimated based on standard Cisco DoS metrics for this component*
- **CWE:** CWE-399 (Resource Management Errors) / CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
- **Products:**
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
- **Versions:** Multiple versions are affected. Users must check specific Cisco software lineages (e.g., 9.16, 9.18, 7.0, 7.2) for the fixed interim or major releases.
- **Configurations:** Systems configured with **Remote Access SSL VPN** (AnyConnect) enabled.
## Vulnerability Description
A vulnerability in the implementation of the SSL VPN service within Cisco ASA and FTD software allows an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The flaw typically stems from improper handling or parsing of specific HTTPS requests directed at the VPN gateway. By sending a crafted sequence of packets, an attacker can exhaust system resources or cause the `lina` process (the main data plane process) to crash and reload.
## Exploitation
- **Status:** **Exploited in the wild.** This CVE has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (The device or VPN service becomes unavailable during the crash/reload cycle).
## Remediation
### Patches
Cisco has released software updates that address this vulnerability. It is recommended to migrate to the following minimum fixed releases (or later):
- **ASA:** Refer to Cisco's software central for the specific fixed maintenance release for your train (e.g., upgrade to latest 9.16.x, 9.18.x).
- **FTD:** Upgrade to latest patched versions within the 7.x branches.
### Workarounds
- **Control Plane ACLs:** Restrict access to the SSL VPN interface to known, trusted IP addresses if possible.
- **Protocol Switching:** If viable, utilize IPsec VPN instead of SSL VPN until patches can be applied, as the flaw resides specifically in the SSL VPN (HTTPS) handling component.
## Detection
- **Indicators of Compromise:** Unexpected reloads of the Cisco ASA/FTD device with logs indicating a crash in the `lina` process.
- **Detection Methods:** Monitor Syslog for `%ASA-1-103001` (Resource exhaustion) or `%ASA-4-711004` (High CPU/Service interruption) messages. Review crash dumps (available via `show crashinfo`) for signatures related to the SSL VPN handler.
## References
- **Cisco Security Advisory:** hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349
- **Cisco Security Portal:** hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/publicationListing[.]x