CVE-2024-20260: Cisco ASA and FTD SSL VPN denial-of-service scope expansion

Quick Answer

CVE-2024-20260 can exhaust memory on vulnerable Cisco ASA and FTD devices with SSL VPN or the management HTTP server enabled, slowing or stopping SSL VPN service without authentication. Cisco expanded the scope beyond virtual appliances to hardware platforms; FMC remains excluded. There is no workaround, and the fixed release depends on the installed platform and train.

Last verified: 2026-09-17 UTC from Cisco's advisory and CSAF record. Recheck both the affected-products and fixed-software sections before a production change.

Context

Status At A Glance

Product scope	Cisco Secure Firewall ASA / FTD
CVE	CVE-2024-20260
TechGeeks response tier	P1 — urgent
Publication	Material revision of an older advisory
First published	2024-10-23T16:00:00+00:00
Last updated	2026-09-16T16:05:50+00:00
Cisco advisory SIR	High
CVE-specific Cisco SIR	Not separately stated
CVSS base score / severity	8.6 — High
CVSS vector	CVSS v3.1 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CISA KEV at last check	No — this is separate from Cisco severity and is not proof of no exploitation.
Cisco exploitation statement	The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

What Happened

An unauthenticated remote attacker can open enough SSL/TLS connections to exhaust memory and buffers used by the affected ASA or FTD device. SSL VPN performance can deteriorate until connections stop working. Stopping the traffic allows resources to recover slowly; a manual reload may restore service sooner, but is not a software fix. Cisco originally limited CVE-2024-20260 to ASAv and FTDv, then expanded the advisory to hardware appliances. The source-reconciliation note below explains that scope change.

Affected Scope

For ASA and FTD hardware and virtual appliances, first establish whether the installed release is vulnerable using the live advisory or Cisco Software Checker. In the ASA/FTD CLI, show asp table socket | include SSL|DTLS checks whether SSL/TLS processing is configured. Cisco says empty output excludes this configuration condition; output must be interpreted together with the vulnerable-release requirement, not as evidence that a fixed release is vulnerable. Secure FMC Software is not affected.

Match the exact hardware or virtual platform, installed train, patch level, enabled service, role, and management or data-plane exposure. A Cisco product-family name alone does not establish applicability.

Steps

What To Do Now

1. Confirm. Inventory Cisco Secure Firewall ASA / FTD and record platform, exact release, patch level, enabled feature, role, and exposure.
2. Preserve. Save UTC context plus off-device authentication, management, firewall, network, endpoint, and SIEM evidence before logs rotate or a disruptive change removes context.
3. Scope. Compare each asset with the live Cisco advisory, including configuration prerequisites and exclusions.
4. Reduce exposure. Cisco documents no workaround for this CVE. Use only supported exposure controls while preparing the permanent fix.
5. Remediate. Follow the CVE-specific method and release guidance under Permanent Fix below.
6. Validate. Confirm the resulting version, service health, logging, expected access, an expected denial, failover or cluster state, and representative dependent workflows.
7. Escalate. If evidence or exposure creates concern, open incident response and Cisco TAC recovery work rather than treating patch completion as proof of trust.

Fixed Releases And Mitigation

Investigation And Recovery

Review management authentication, account and privilege changes, API and web requests, configuration changes, crashes or restarts, resource pressure, and relevant external network telemetry for the vulnerable period. Preserve original evidence and follow Cisco TAC or incident-response guidance for containment, credential rotation, trusted rebuild, or service restoration when findings warrant it.

Notes

Exploitation Evidence

Cisco's exact status at the last check: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

This CVE was not present in the TechGeeks CISA KEV snapshot at the last check. Cisco's 'not aware' statement and absence from KEV are time-bounded evidence, not claims that exploitation is impossible or has never happened. Severity and exploitation status remain separate signals.

Validation And Boundaries

This notice is documentation-backed. TechGeeks did not reproduce the exploit or independently test every fixed build. It does not prove that all members of the product family are affected, that the activity is widespread, that a clean indicator search excludes compromise, or that an update restored trust. Cisco's live advisory controls affected and fixed release information.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices
• What to Do When a Device Hits CISA KEV
• Router CVE Exposure, Version, and Mitigation Checklist
• IoT Firmware Update and End-of-Support Checklist
• Live Protect and Runtime Vulnerability Shielding

References

• Cisco security advisory
• Cisco CSAF record
• Cisco Security Advisory RSS feed
• NVD identifier record

Wrap-Up

Record whether CVE-2024-20260 applies. If it does, assign an owner and deadline appropriate to the High Cisco advisory SIR, preserve the evidence, complete Cisco's remediation, and document the validated result.

Correction policy: A material Cisco revision to scope, severity, exploitation status, workarounds, fixed software, or recovery guidance triggers an update and a new verification date.