CVE-2026-20349

Cisco — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

CISA KEV · in the CISA KEV catalog since 2026-08-11

What EVULNABLE says

EVULNABLE Risk · priority 75/100 Urgent Raised to the floor for a confirmed exploited vulnerability. Intelligence coverage 75/90 — no pre-patch disclosure data
Overdue by 20 daysCISA KEVActively Exploited

Why it matters: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.

Patch This Cycle

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

Published measurements for CVE-2026-20349
MeasureValueSource
CVSS base score 8.6 estimated Cisco
FIRST EPSS 0.022 (81.4th pctl) FIRST
Actively exploited Confirmed CISA KEV
Ransomware campaign use Unknown or none CISA KEV
CISA remediation deadline 2026-08-14 — Overdue by 20 days CISA KEV
Intelligence coverage 75/90 — no pre-patch disclosure data

What CISA says to do

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.