Cisco IKEv2 Vulnerability CVE-2026-20249: A Crafted Certificate Can Reboot ASA and FTD Firewalls, and the Fixed Versions to Install

Cisco says an attacker on the internet with no login can force Cisco Secure Firewall ASA and Firewall Threat Defense (FTD) devices to reload. They do it by trying to connect to an IKEv2 VPN with a specially crafted certificate. For your business, that means remote staff lose their VPN, branch tunnels drop, and everything that passes through that firewall stops while it restarts.

The flaw is tracked as CVE-2026-20249 (Cisco bug ID CSCwt42671). Cisco rates it High, with a CVSS 3.1 base score of 8.6. Cisco published the advisory on Wednesday, September 16, 2026, and updated it on Friday, September 18, 2026 (version 1.1) to add the fixed release tables. Cisco lists no workarounds. Upgrading is the only fix.

What is confirmed and what is not

Confirmed by Cisco's advisory:

• The attacker does not need to log in and can work remotely.
• The cause is a logic error in the certificate authentication step of setting up an IKEv2 connection. A crafted certificate crashes the IKEv2 process and the device reloads.
• Only devices with IKEv2 VPN enabled and certificate authentication configured are affected.
• Cisco Secure Firewall Management Center (FMC) Software is not affected.
• There are no workarounds.
• Cisco's security team (PSIRT) says it is not aware of any public announcements or malicious use of this flaw.

What the scoring tells you: the CVSS vector rates confidentiality and integrity impact as none and availability impact as high. Going by Cisco's own rating, this is an outage bug, not a data theft bug.

What is not known or not settled:

• Cisco has not published what makes a certificate trigger the crash.
• Cisco does not say how long a reload takes or how a failover pair behaves.
• Who found the flaw is unclear. Cisco's advisory says it was found while resolving a Cisco Technical Assistance Center (TAC) support case. The official CVE record lists the discovery source as "External." Both could be true, for example if a customer's case surfaced it, but neither record says so. We cannot tell you who first ran into it.

Is my Cisco ASA or FTD firewall affected?

Your device is affected only if both of these are true. Cisco gives these two commands:

1. IKEv2 is enabled on an interface. Run show running-config crypto ikev2 | include enable. Any output, such as crypto ikev2 enable outside client-services port 443, means IKEv2 is on. No output means the device is not affected.
2. A trustpoint certificate is configured for IKEv2. Run show running-config crypto ikev2 | include trust. Output such as crypto ikev2 remote-access trustpoint VPN-Cert means certificate authentication is set up. No output means the device is not affected.

To find your current software version, run show version on ASA, or check the device page in your management console for FTD.

Cisco ASA fixed versions

Cisco notes: "Customers who installed one of the listed hot fix releases must install the listed first fixed release." Hot fix build numbers run higher than the fixed build numbers, so a bigger number does not mean you are covered. Cisco's ASA table is hard to read in places, so confirm your exact build in the Cisco Software Checker before you schedule work.

Cisco FTD fixed versions

Cisco recommends moving to these first fixed releases because they contain fixes for multiple vulnerabilities.

The September 2026 Cisco firewall hardening release

Cisco lists this advisory next to a separate advisory published the same day: the Secure Firewall ASA, Threat Defense, and Management Center Software Hardening Release: September 2026. Cisco rates that one Critical (CVSS 9.9). It covers CVE-2026-20329 through CVE-2026-20336, and Cisco says two of the vulnerabilities in that class are known to be actively exploited.

The fixed version tables in the two advisories show the same version numbers for each train. However, neither advisory says the fixed builds are identical in every case, and the hardening advisory does not mention CVE-2026-20249. Don't assume one upgrade covers both. When you pick a target build, check it against both advisories in the Cisco Software Checker.

What to do this week

• List every ASA and FTD device, including spares and branch units.
• Run the two show running-config crypto ikev2 checks on each one and note which have IKEv2 with a trustpoint.
• Record the current version (show version on ASA) and compare it to the tables above.
• If you are on a listed hot fix build, plan the move to the first fixed release.
• Put your target build into the Cisco Software Checker and confirm it covers this advisory and the September 2026 hardening release.
• Read Cisco's upgrade path and compatibility guides for your train before upgrading, especially FTD devices managed by FMC.
• Schedule a maintenance window, tell remote staff and branch sites, and test VPN logins afterward.
• Until you patch, watch for unexpected reloads in device logs and in your monitoring.

Why it matters for a company network

The firewall is the front door for the whole office. When it reloads, it isn't only the VPN that drops: anything routed through that box is interrupted until it comes back. For a medical practice, a law firm or a manufacturer with a remote plant, that can mean staff locked out of files, phones and line-of-business apps in the middle of the day.

There is an irony here too. Certificate authentication is often chosen because it is stronger than passwords alone, and that is exactly the setup this bug affects. Cisco does not list disabling certificate authentication as a workaround, so don't weaken your VPN to dodge this. Patch it.

Lastly, a bug with no known exploitation today is the easiest kind to fix. You can plan a calm maintenance window now instead of scrambling after an outage.

Cisco IKEv2 vulnerability questions people are asking

Is CVE-2026-20249 being exploited?

Cisco says it is not aware of public announcements or malicious use. That can change, so check the advisory again before your maintenance window.

Can attackers steal data with this Cisco firewall VPN bug?

Cisco's scoring rates confidentiality and integrity impact as none. The confirmed impact is a denial of service: the device reloads.

Is there a workaround?

No. Cisco says no workarounds address this vulnerability. Upgrade to a fixed release.

Does this affect Cisco Secure Client or AnyConnect users?

It depends on the firewall, not the client. If the IKEv2 enable check returns nothing, Cisco says the device is not affected, even if users connect over SSL.

Are site-to-site VPNs affected?

Cisco describes the condition as IKEv2 VPN with certificate authentication and gives two checks. It does not separate remote access from site-to-site. If your results are unclear, treat the device as affected and upgrade.

Is Cisco Firewall Management Center affected?

No. Cisco confirmed that FMC Software is not affected by this flaw. FMC is still covered by the separate September 2026 hardening release, though, so check it there.

I'm on 9.24.1.221. Am I fixed?

No. Cisco lists 9.24.1.221 as an affected hot fix build. Install 9.24.1.26 or a later fixed release, as Cisco directs.

The bigger lesson

Your firewall is shared infrastructure. When it goes down, the whole business goes down with it. Knowing which features are switched on, which build you run and who is responsible for upgrading it turns an advisory like this into a routine task instead of an emergency. Keep an up-to-date inventory, check advisories against your real configuration, and patch on a schedule you control.

Want help hardening your firewall and VPN? See security hardening or request a tech quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Cisco Security Advisory cisco-sa-asaftd-ikev2cert-dos-uWyc2xtv; CVE-2026-20249 record; Cisco Secure Firewall Hardening Release: September 2026.