CVE-2026-20349High· 8.6▾ Abyssal⚠ Exploited in the wild0dayPoC availableA vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause th…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 47.3 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Aug 14, 2026
2.2%
Last analysed / modified upstream
1 GitHub repo
Added to the CISA catalog on Aug 11, 2026. Federal remediation due Aug 14, 2026. View catalog ↗
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
adaptive_security_appliance_software = 9.16.1adaptive_security_appliance_software = 9.16.1.28adaptive_security_appliance_software = 9.16.2adaptive_security_appliance_software = 9.16.2.3adaptive_security_appliance_software = 9.16.2.7adaptive_security_appliance_software = 9.16.2.11adaptive_security_appliance_software = 9.16.2.13adaptive_security_appliance_software = 9.16.2.14adaptive_security_appliance_software = 9.16.3adaptive_security_appliance_software = 9.16.3.3adaptive_security_appliance_software = 9.16.3.14adaptive_security_appliance_software = 9.16.3.15adaptive_security_appliance_software = 9.16.3.19adaptive_security_appliance_software = 9.16.3.23adaptive_security_appliance_software = 9.16.4adaptive_security_appliance_software = 9.16.4.9adaptive_security_appliance_software = 9.16.4.14adaptive_security_appliance_software = 9.16.4.19adaptive_security_appliance_software = 9.16.4.27adaptive_security_appliance_software = 9.16.4.38adaptive_security_appliance_software = 9.16.4.39adaptive_security_appliance_software = 9.16.4.42adaptive_security_appliance_software = 9.16.4.48adaptive_security_appliance_software = 9.16.4.55adaptive_security_appliance_software = 9.16.4.57adaptive_security_appliance_software = 9.16.4.61adaptive_security_appliance_software = 9.16.4.62adaptive_security_appliance_software = 9.16.4.67adaptive_security_appliance_software = 9.16.4.70adaptive_security_appliance_software = 9.16.4.71adaptive_security_appliance_software = 9.16.4.76adaptive_security_appliance_software = 9.16.4.82adaptive_security_appliance_software = 9.16.4.84adaptive_security_appliance_software = 9.16.4.85adaptive_security_appliance_software = 9.16.4.89adaptive_security_appliance_software = 9.16.4.92adaptive_security_appliance_software = 9.18.1adaptive_security_appliance_software = 9.18.1.3adaptive_security_appliance_software = 9.18.2adaptive_security_appliance_software = 9.18.2.5adaptive_security_appliance_software = 9.18.2.7adaptive_security_appliance_software = 9.18.2.8adaptive_security_appliance_software = 9.18.3adaptive_security_appliance_software = 9.18.3.39adaptive_security_appliance_software = 9.18.3.46adaptive_security_appliance_software = 9.18.3.53adaptive_security_appliance_software = 9.18.3.55adaptive_security_appliance_software = 9.18.3.56adaptive_security_appliance_software = 9.18.4adaptive_security_appliance_software = 9.18.4.5adaptive_security_appliance_software = 9.18.4.8adaptive_security_appliance_software = 9.18.4.22adaptive_security_appliance_software = 9.18.4.24adaptive_security_appliance_software = 9.18.4.29adaptive_security_appliance_software = 9.18.4.34adaptive_security_appliance_software = 9.18.4.40adaptive_security_appliance_software = 9.18.4.47adaptive_security_appliance_software = 9.18.4.50adaptive_security_appliance_software = 9.18.4.52adaptive_security_appliance_software = 9.18.4.53adaptive_security_appliance_software = 9.18.4.57adaptive_security_appliance_software = 9.18.4.66adaptive_security_appliance_software = 9.18.4.67adaptive_security_appliance_software = 9.18.4.68adaptive_security_appliance_software = 9.18.4.71adaptive_security_appliance_software = 9.18.4.76adaptive_security_appliance_software = 9.18.4.82adaptive_security_appliance_software = 9.18.4.90adaptive_security_appliance_software = 9.18.4.135adaptive_security_appliance_software = 9.19.1adaptive_security_appliance_software = 9.19.1.5adaptive_security_appliance_software = 9.19.1.9adaptive_security_appliance_software = 9.19.1.12adaptive_security_appliance_software = 9.19.1.18adaptive_security_appliance_software = 9.19.1.22adaptive_security_appliance_software = 9.19.1.24adaptive_security_appliance_software = 9.19.1.27adaptive_security_appliance_software = 9.19.1.28adaptive_security_appliance_software = 9.19.1.31adaptive_security_appliance_software = 9.19.1.37adaptive_security_appliance_software = 9.19.1.38adaptive_security_appliance_software = 9.19.1.42adaptive_security_appliance_software = 9.20.1adaptive_security_appliance_software = 9.20.1.5adaptive_security_appliance_software = 9.20.2adaptive_security_appliance_software = 9.20.2.10adaptive_security_appliance_software = 9.20.2.21adaptive_security_appliance_software = 9.20.2.22adaptive_security_appliance_software = 9.20.3adaptive_security_appliance_software = 9.20.3.4adaptive_security_appliance_software = 9.20.3.7adaptive_security_appliance_software = 9.20.3.9adaptive_security_appliance_software = 9.20.3.10adaptive_security_appliance_software = 9.20.3.13adaptive_security_appliance_software = 9.20.3.16adaptive_security_appliance_software = 9.20.3.20adaptive_security_appliance_software = 9.20.4adaptive_security_appliance_software = 9.20.4.7adaptive_security_appliance_software = 9.20.4.10adaptive_security_appliance_software = 9.20.4.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76504Critical· 9.8A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
CVE-2026-76460Critical· 10.0A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint
CVE-2026-20321Medium· 6.5A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user
CVE-2026-76471Critical· 9.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The…
CVE-2026-76486Critical· 9.8A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Deni…
CVE-2026-76485Critical· 9.8A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Deni…