CVE-2026-20349 Microsoft Sentinel · KQL

Detect Cisco ASA/FTD VPN Web Services Heap Inspection DoS (CVE-2026-20349) in Microsoft Sentinel

Detects exploitation attempts and impact indicators for CVE-2026-20349, a heap inspection vulnerability (CWE-244) in the VPN web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). An unauthenticated remote attacker can send crafted HTTPS requests to the SSL VPN/WebVPN interface to exhaust heap memory and force a device reload, causing denial of service. This CVE is on the CISA KEV list. Detection focuses on ASA/FTD syslog reload/traceback events, WebVPN service crashes, and anomalous volumes of unauthenticated SSL VPN handshake activity against the management/VPN interface.

MITRE ATT&CK

Tactic
Impact

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let VpnCrashSignals = dynamic(["%ASA-3-199010", "%ASA-1-199001", "Traceback", "reload", "WebVPN", "SVC", "unexpected"]);
Syslog
| where Facility in ("local0", "local4", "local7") or SyslogMessage has_any ("%ASA-", "%FTD-")
| where SyslogMessage has_any (VpnCrashSignals)
| where SyslogMessage has_any ("Traceback", "reload was requested", "unexpected", "lina", "WebVPN", "SSL VPN")
| extend Host = tostring(HostName), Sev = extract(@"%(?:ASA|FTD)-(\d)-", 1, SyslogMessage)
| summarize CrashEvents = count(), Messages = make_set(SyslogMessage, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Host
| where CrashEvents >= 1
| order by CrashEvents desc
high severity medium confidence

Surfaces ASA/FTD syslog messages indicating a traceback, unexpected reload, or WebVPN/lina process failure consistent with heap exhaustion DoS exploitation of CVE-2026-20349.

Data Sources

Cisco ASA SyslogCisco FTD SyslogFirewall

Required Tables

Syslog

False Positives & Tuning

  • Planned administrative reloads or software upgrades of the ASA/FTD appliance during a change window
  • Hardware faults or power events unrelated to VPN traffic that also produce traceback/reload messages
  • Non-security process restarts during high-availability failover testing

Other platforms for CVE-2026-20349

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate ASA traceback/reload syslog ingestion

    Expected signal: A Cisco ASA syslog event containing 'Traceback', 'reload was requested', and 'WebVPN' keywords ingested into the SIEM.

  2. Test 2Simulate high-rate unauthenticated SSL VPN handshakes

    Expected signal: A spike of inbound HTTPS/TLS handshake connection logs to the VPN interface from a single source in a short window.

  3. Test 3Simulate FTD lina process crash syslog

    Expected signal: A Cisco FTD syslog event with 'lina', 'unexpected termination', 'WebVPN', and 'Traceback' keywords ingested into the SIEM.

Last updated: 2026-08-12 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected host is a Cisco ASA or FTD appliance and check whether its running version is listed as fixed in Cisco advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF; if not patched, treat as exploitable.
  2. Correlate the traceback/reload timestamp with SSL VPN/WebVPN interface access logs and inbound HTTPS connection volume to the VPN interface from external sources.
  3. Determine whether the reload was planned (change ticket, admin login, upgrade) or unexpected; unexpected reloads with no admin activity strongly indicate exploitation.
  4. Review source IPs establishing SSL VPN handshakes immediately before the crash and check them against threat intelligence and KEV exploitation reporting.

Containment

  1. Apply the Cisco fixed software release for CVE-2026-20349 to affected ASA/FTD appliances as prioritized under CISA BOD 26-04.
  2. If patching is not immediately possible, restrict access to the SSL VPN/WebVPN interface via ACLs or control-plane policing to trusted source ranges, or disable WebVPN if not required.
  3. Enable rate limiting on the VPN interface and place upstream filtering to drop crafted/anomalous HTTPS requests to the appliance.

Evidence Collection

  1. Export the ASA/FTD syslog and crashinfo/traceback files from flash (show crashinfo, show tech-support) covering the reload window.
  2. Capture SSL VPN/WebVPN connection logs, `show vpn-sessiondb` output, and memory statistics (show memory) before and around the crash for forensic analysis.
  3. Preserve firewall/netflow records of inbound HTTPS sessions to the VPN interface identifying candidate attacker source IPs and request timing.

Escalation Criteria

  • !Escalate to incident response if repeated unexpected reloads occur, indicating a sustained DoS campaign, or if reloads coincide with external unauthenticated VPN handshake spikes.
  • !Escalate to network operations and management if the appliance provides critical remote-access connectivity and availability is impacted, invoking business continuity procedures.
  • !Escalate per CISA BOD 26-04 timelines if the appliance is internet-facing and unpatched against this KEV-listed vulnerability.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >ASA/FTD crashinfo and traceback files stored in device flash
  • >Syslog reload/traceback messages (%ASA-1-199001, %ASA-3-199010)
  • >SSL VPN session database and memory utilization snapshots
  • >Inbound HTTPS/NetFlow records to the VPN interface preceding the reload

Tuning Guidance

Baseline expected reload events by correlating with your change-management system and suppress reloads tied to approved maintenance windows or HA failover tests. Focus alerting on unexpected reloads from internet-facing appliances that correlate with external, unauthenticated SSL VPN handshake spikes. If WebVPN is not deployed, tighten the query to alert only on lina/traceback events and reduce syslog-message noise by pinning to message IDs 199001/199010.

Hunting Queries

Hunts for hosts experiencing more than one reload/traceback per hour, a signature of repeated DoS attempts rather than isolated planned reloads.

Hunting — KQL
kql 
Syslog | where SyslogMessage has_any ("%ASA-", "%FTD-") | where SyslogMessage has "reload" or SyslogMessage has "Traceback" | summarize reloads=count() by HostName, bin(TimeGenerated, 1h) | where reloads > 1
Hunting — SPL
spl 
index=network sourcetype IN ("cisco:asa","cisco:ftd") ("reload" OR "Traceback") | timechart span=1h count by host | where count > 1

Atomic Red Team Tests

Test 1 Simulate ASA traceback/reload syslog ingestion
linux

Injects a synthetic Cisco ASA traceback and unexpected reload syslog message into the SIEM to validate detection logic without touching production hardware.

Command

bash 
logger -n 127.0.0.1 -P 514 -d "<163>%ASA-1-199001: Reload was requested. WebVPN process encountered unexpected termination. Traceback: 0x00007f..."

Cleanup

bash 
# No cleanup required; remove test log entries from the SIEM index if desired

Expected Telemetry

A Cisco ASA syslog event containing 'Traceback', 'reload was requested', and 'WebVPN' keywords ingested into the SIEM.

Expected Detection

The KQL/SPL detection matches the synthetic message and raises a crash_events >= 1 alert for the test host.

Test 2 Simulate high-rate unauthenticated SSL VPN handshakes
linux

Generates a burst of TLS handshakes against a lab ASA/FTD WebVPN interface to model the pre-crash connection spike associated with the heap DoS.

Command

bash 
for i in $(seq 1 500); do timeout 1 openssl s_client -connect LAB_ASA_IP:443 -servername vpn </dev/null >/dev/null 2>&1 & done; wait

Cleanup

bash 
pkill -f 'openssl s_client -connect LAB_ASA_IP:443' 2>/dev/null || true

Expected Telemetry

A spike of inbound HTTPS/TLS handshake connection logs to the VPN interface from a single source in a short window.

Expected Detection

Hunting queries surface an anomalous SSL VPN handshake volume correlated in time with any subsequent reload event.

Test 3 Simulate FTD lina process crash syslog
linux

Injects a synthetic Cisco FTD lina engine failure/traceback message to validate FTD-specific detection coverage.

Command

bash 
logger -n 127.0.0.1 -P 514 -d "<163>%FTD-3-199010: lina process unexpected termination, memory allocation failure in WebVPN handler; Traceback recorded"

Cleanup

bash 
# No cleanup required; purge synthetic test events from the SIEM if desired

Expected Telemetry

A Cisco FTD syslog event with 'lina', 'unexpected termination', 'WebVPN', and 'Traceback' keywords ingested into the SIEM.

Expected Detection

The detection matches the FTD message via the %FTD-/lina/traceback conditions and raises an alert for the test host.

Related Detections

Tactic Hub

TA0040Impact

Related Techniques

T1499.002Service Exhaustion FloodT1190Exploit Public-Facing Application

Same Tactic: Impact

Popular Detections