Our automated tracking framework flagged that CISA added CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)) to the Known Exploited Vulnerabilities (KEV) catalog on August 12, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-20349 by August 14, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-20349 |
| Vendor / product | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) |
| Vulnerability | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability |
| CVSS base score | 8.6 |
| Added to KEV | August 11, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | August 14, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Cisco currently ranks #8 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 96 |
| Median lag (public → KEV listing) | 1245 days |
| 0-day rate (exploited at or before disclosure) | 15% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1665 tracked KEV entries is 271 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
| CVE-2008-4128 | IOS | July 13, 2026 | 6507 | No |
| CVE-2026-20230 | Unified Communications Manager | June 25, 2026 | 22 | No |
| CVE-2026-20262 | Catalyst SD-WAN Manager | June 15, 2026 | 0 | No |
| CVE-2026-20245 | Catalyst SD-WAN Manager | June 9, 2026 | 5 | No |
Defense guide: How to Detect DDoS Attack: Warning Signs & Defense Playbook — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-20349 to its Known Exploited Vulnerabilities Catalog, effective August 11, 2026, with a federal patch deadline of August 14, 2026. This heap inspection vulnerability in Cisco Secure Firewall ASA and FTD carries a CVSS base score of 8.6. The extremely short federal patch deadline highlights the urgent need for all organizations using these products to prioritize immediate patching.
Organizations most exposed are those directly leveraging Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). It’s a 0-day KEV listing, meaning it was added to the catalog on the same day it became public. This indicates that attackers are actively targeting this vulnerability now. Patching is paramount to mitigate the significant risk posed by this actively exploited vulnerability.
Patch before the August 14th deadline. If you cannot meet this deadline, restrict access to Cisco Secure Firewall devices. Implement network segmentation and strict access controls, and enhance monitoring for anomalous activity originating from or targeting these devices.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
