Two Cisco Secure Firewall Flaws in KEV: One Reloads Your ASA, One Hands Out a Login

CISA has added two Cisco Secure Firewall vulnerabilities to its Known Exploited Vulnerabilities catalog in the space of two weeks. Cisco PSIRT confirms active exploitation of both. They affect different products, they fail in different ways, and they have almost nothing in common except the thing that decides whether you are in the blast radius: which services your configuration exposes.

CVE-2026-20349 lets an unauthenticated attacker reload an ASA or FTD appliance at will. CVE-2026-20316 lets an unauthenticated attacker log in to Secure Firewall Management Center using credentials Cisco shipped in the product. Neither requires a foothold, credentials, or user interaction.

One note on the deadlines before the detail. The remediation dates in the KEV catalog are binding on federal civilian executive branch agencies under CISA's BOD 26-04. If you are not one, they are not a legal obligation. They are still the best available public signal of how fast a vulnerability is being used, and both of these carry short ones.

CVE-2026-20349: a crafted HTTP request reloads the firewall

Per the NVD record, the flaw is in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. It is caused by insufficient error checking when processing HTTP requests. An attacker sends a crafted HTTP request to the Remote Access SSL VPN service, and the device reloads. Repeat as desired.

Cisco PSIRT scores it CVSS 3.1 base 8.6 (High), vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Read the impact metrics carefully, because they are unusually informative: confidentiality none, integrity none, availability high. This bug does not read your data or change your rules. It takes the firewall down. The scope-changed flag reflects that a dead perimeter device affects far more than itself.

CISA added it on August 11, 2026 with a federal due date of August 14, 2026, a three-day window. Cisco states plainly that there are no workarounds. The advisory is cisco-sa-asaftd-vpn-dos-dzv4mQFF.

The config lines that decide whether this applies to you

This is the part worth acting on today, and Cisco publishes it directly. The vulnerability needs an SSL listen socket, and only certain features create one. The advisory lists the potentially vulnerable features alongside the basic configuration that enables each, as it appears in show running-config:

• → SSL VPN. webvpn followed by enable <interface_name>.
• → IKEv2 Remote Access VPN with client services. crypto ikev2 enable <interface_name> followed by client-services port <port_numbers>.
• → Zero Trust Network Access. zero-trust enable. This feature exists only in FTD Software.

On FTD, remote access VPN is enabled from Devices then VPN then Remote Access in FMC, or from Remote Access VPN in Firewall Device Manager, rather than from a CLI line you can grep.

If none of those are configured, this particular vulnerability has no listener to reach. That is a genuinely useful answer, and it takes one look at a config to get. It is not a reason to skip the hot fix, but it does tell you whether you are patching tonight or on Thursday.

Cisco has confirmed that CVE-2026-20349 does not affect Secure Firewall Management Center.

CVE-2026-20316: a password Cisco shipped in the product

The second one is a different category of failure. Secure Firewall Management Center, formerly Firepower Management Center, contains static user credentials for a low-privileged account in its web interface (CWE-259, use of hard-coded password). An unauthenticated remote attacker can use that account to log in and read sensitive data.

The CVSS 3.1 base score from Cisco PSIRT is 5.3 (Medium), and this is one of the clearest examples you will find of why a base score is not a priority. Cisco explicitly assigned the advisory a Security Impact Rating of High rather than Medium, and said why: the vulnerability can be combined with other Secure FMC vulnerabilities to elevate privileges. A low-privileged authenticated foothold on the box that manages every one of your firewalls is not a medium problem.

CISA added it on July 29, 2026 with a federal due date of August 1, 2026. That date has passed. Cisco PSIRT became aware of active exploitation in July 2026. The advisory is cisco-sa-fmc-static-cred-BET3Cjh.

Affected versions, from the NVD record, are FMC 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12, and 10.0.0 through 10.0.1. Cisco confirms the following are not vulnerable: Cloud-Delivered FMC, Firewall Device Manager, ASA Software, FTD Software, and Security Cloud Control.

NVD carries one mitigating note directly from Cisco: if the FMC management interface does not have public internet access, the attack surface associated with this vulnerability is reduced. Management plane exposure is a configuration decision, and this is a reminder of what it costs when it goes the wrong way.

Check FMC for compromise before you patch it

Cisco publishes an indicator of compromise for CVE-2026-20316, and it deserves more attention than the patch note. From expert mode on the FMC device:

zgrep "package_info.*license" /var/log/messages*

If the output includes a reference to /var/tmp/license.tmp, Cisco says the vulnerability may have been exploited on that device, and you should contact Cisco TAC immediately for recovery options.

The reason to run this before you patch is stated in the advisory itself: the hot fixes are for preventing future exploitation. They are not a remedy for a device that has already been used. Patching first does not erase the evidence, but it does remove the urgency that would have made you look, and an unexamined FMC is the wrong thing to declare fixed.

Fixed releases

Cisco released hot fixes for both, downloadable from the Software Center on Cisco.com. For Secure FMC (CVE-2026-20316), by release train: 7.0 takes Hotfix GB-7.0.9.1-3, 7.2 takes HL-7.2.11.1-4, 7.4 takes HG-7.4.7.1-3, 7.6 takes CY-7.6.5.1-2, 7.7 takes AM-7.7.12.1-2, and 10.0 takes P-10.0.1.1-2.

For Secure Firewall ASA (CVE-2026-20349): 9.16 takes hot fix 89.16.4.50, 9.18 takes 89.18.4.50, 9.20 takes 9.20.4.235, 9.22 takes 9.22.3.191, 9.23 takes 9.23.1.211, and 9.24 takes 9.24.1.221. Note the versioning trap Cisco calls out: when you install a hot fix whose name starts with 89, you must also install ASDM release 7.24.1.374, because earlier ASDM builds do not recognize that ASA numbering format. FTD hot fixes are published per release train (7.0, 7.2, 7.4, 7.6, 7.7 and 10.0) with a separate file per hardware platform, so match the file to your appliance rather than to the train alone.

Cisco also provides the Cisco Software Checker, which maps a specific software release to the advisories that affect it and the earliest release that fixes each. For version-specific certainty, that tool and the advisories themselves are the authority, not this page.

What a config audit can and cannot tell you here

Both of these vulnerabilities live in running software. A configuration audit reads a text file. It is worth being precise about where that line falls, because the honest answer is more useful than a broad claim.

What no config audit can do, ours included: it cannot see the device filesystem, so it cannot run the FMC log check above. It cannot prove a binary was patched or that a hot fix installed cleanly. It cannot certify that a device which was exposed is now clean. For CVE-2026-20316 in particular, the config file is not where the answer lives.

What CRWLR does not cover today: we parse Cisco ASA show running-config output. We do not parse FTD configurations or FMC exports, so for CVE-2026-20316 we have nothing to offer beyond the analysis on this page. We also do not currently read the webvpn and remote-access VPN blocks of an ASA config, which means we cannot answer the CVE-2026-20349 exposure question for you. That check is the three-item list above, and today it is a manual one.

What an ASA config audit does surface is the surrounding posture, which is what turns a reload into an outage and a foothold into an incident. On a Cisco ASA configuration, CRWLR flags inbound rules that permit any source from an external interface, high-risk services reachable from the internet such as RDP, missing default-deny at the end of an access list, allow rules with logging disabled, administrator accounts without two-factor authentication and without role separation, absent high-availability configuration, and the multi-hop attack paths those rules create between your outside, inside and DMZ interfaces.

That last one is the relevant lens for CVE-2026-20349. The vulnerability is availability-only. Whether losing this appliance is an inconvenience or an outage is decided by whether anything fails over, and a config audit answers that question directly.

FAQ

What is CVE-2026-20349?

CVE-2026-20349 is a denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. Insufficient error checking when processing HTTP requests lets an unauthenticated, remote attacker send a crafted HTTP request that causes the device to reload. Cisco PSIRT scores it CVSS 3.1 base 8.6 (High). CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026, with a federal remediation due date of August 14, 2026.

Is CVE-2026-20349 being exploited?

Yes. Cisco's advisory states that in August 2026 the Cisco Product Security Incident Response Team became aware of active exploitation of this vulnerability. Its presence in the CISA KEV catalog reflects the same finding. The vulnerability was found during Cisco internal security testing and was also reported by Valerio Brussani.

Which ASA configurations are vulnerable to CVE-2026-20349?

The vulnerability requires a feature that enables SSL listen sockets. Cisco lists three: SSL VPN, configured with webvpn then enable <interface_name>; IKEv2 Remote Access VPN with client services, configured with crypto ikev2 enable <interface_name> then client-services port <port_numbers>; and Zero Trust Network Access, configured with zero-trust enable, which is available only in FTD Software. If none of these are configured, there is no exposed listener for this vulnerability.

Is there a workaround for CVE-2026-20349?

No. Cisco states that there are no workarounds that address this vulnerability. Cisco has released hot fixes per ASA release train (9.16, 9.18, 9.20, 9.22, 9.23 and 9.24) and per FTD release train (7.0, 7.2, 7.4, 7.6, 7.7 and 10.0), available from the Software Center on Cisco.com. If you install an ASA hot fix whose name begins with 89, Cisco requires ASDM release 7.24.1.374, because earlier ASDM releases do not recognize that numbering format.

What is CVE-2026-20316?

CVE-2026-20316 is a use of hard-coded password vulnerability (CWE-259) in the web interface of Cisco Secure Firewall Management Center, formerly Firepower Management Center. Static credentials for a low-privileged account allow an unauthenticated, remote attacker to log in and access sensitive data. The CVSS 3.1 base score is 5.3 (Medium), but Cisco assigned the advisory a Security Impact Rating of High because the vulnerability can be used together with other Secure FMC vulnerabilities to elevate privileges. CISA added it to KEV on July 29, 2026, with a federal due date of August 1, 2026.

How do I check whether my FMC was compromised via CVE-2026-20316?

Cisco publishes an indicator of compromise. In expert mode on the FMC device, run zgrep "package_info.*license" /var/log/messages*. If the output includes a reference to /var/tmp/license.tmp, the vulnerability may have been exploited on that device, and Cisco advises contacting the Cisco Technical Assistance Center immediately for recovery options. Run this before patching: Cisco notes the hot fixes prevent future exploitation and are not a remedy for a device that has already been exploited.

Which FMC versions are affected by CVE-2026-20316?

Per the NVD record: 7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12, and 10.0.0 through 10.0.1. Cisco confirms that Cloud-Delivered FMC, Firewall Device Manager, ASA Software, FTD Software and Security Cloud Control are not vulnerable. Hot fixes are published for the 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 trains.

Can a firewall config audit detect these vulnerabilities?

Not directly, and it is worth being exact about why. Both flaws live in running software rather than in configuration, so no config audit can confirm a patch level, inspect the device filesystem, or run the FMC log check. CRWLR parses Cisco ASA show running-config output and does not currently read webvpn or remote-access VPN blocks, so the CVE-2026-20349 exposure check above is a manual one today. CRWLR does not parse FTD or FMC configurations at all. What an ASA config audit does show is the surrounding posture: any-source inbound rules, risky services reachable from the internet, missing default-deny, admin accounts without two-factor authentication, absent high availability, and the attack paths between zones.

Sources: CISA Known Exploited Vulnerabilities catalog, version 2026.08.11. NVD records for CVE-2026-20349 and CVE-2026-20316. Cisco security advisories cisco-sa-asaftd-vpn-dos-dzv4mQFF and cisco-sa-fmc-static-cred-BET3Cjh. CVSS scores and Security Impact Ratings are Cisco PSIRT's. Version-specific remediation should be confirmed against the Cisco advisories and the Cisco Software Checker.