5 minhigh
Cyber Centre Daily Advisory Digest — 2026-08-13 (4 advisories)
The Canadian Centre for Cyber Security published four security advisories on August 13, 2026. The most critical is CVE-2026-20349, a high-severity denial-of-service vulnerability in Cisco ASA and FTD SSL VPN services that is being actively exploited in the wild. Additional advisories cover vulnerabilities in AMD software, GitLab, and WebPros Plesk, the latter involving a privilege escalation flaw via database cloning.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2026-20349Allows an unauthenticated remote attacker to cause a denial-of-service condition by sending crafted HTTP requests to SSL VPN services.
- cveCVE-2026-64639Allows privilege escalation via database cloning.
Detection / Hunteropenrouter
What Happened
The Canadian government's cyber agency released several security warnings on August 13, 2026. The most urgent warning is about a known weakness in Cisco firewall software that attackers are currently using to crash systems that handle remote VPN access. The agency also warned about security flaws in AMD processor utilities, GitLab software development tools, and Plesk web hosting software. Organizations using these products should check if they are affected and install the available updates as soon as possible.
Key Takeaways
- Active exploitation of CVE-2026-20349 affects Cisco ASA and FTD SSL VPN services, causing denial-of-service via crafted HTTP requests.
- AMD released updates for vulnerabilities in Ryzen Master, PDM, and Vitis software.
- GitLab released patch versions 19.0.6, 19.1.4, and 19.2.2 for unspecified vulnerabilities.
- WebPros Plesk is affected by privilege escalation vulnerability CVE-2026-64639 via database cloning.
Affected Systems
- Cisco Secure Firewall ASA Software (9.16.x, 9.18.x, 9.20.x, 9.22.x, 9.23.x, 9.24.x)
- Cisco Secure Firewall Threat Defense (FTD) Software (7.0.x, 7.2.x, 7.4.x, 7.6.x, 7.7.x, 10.0.x)
- AMD Power Design Manager (PDM) Software
- AMD Ryzen Master
- Vitis Libraries and Installers
- GitLab (prior to 19.0.6, 19.1.4, 19.2.2)
- Plesk for Windows/Linux (prior to 18.0.79.6, 18.0.80.2)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-20349 | Cisco Secure Firewall ASA and FTD Software | High | Allows an unauthenticated remote attacker to cause a denial-of-service condition by sending crafted HTTP requests to SSL VPN services. |
| CVE-2026-64639 | WebPros Plesk (Windows/Linux) | Allows privilege escalation via database cloning. |
Attack Chain
- Reconnaissance: Identify internet-accessible Cisco Secure Firewall ASA and FTD systems providing Remote Access SSL VPN services.
- Initial Access: Unauthenticated remote attacker sends a specially crafted HTTP request to the affected SSL VPN service.
- Impact: The firewall reloads unexpectedly, resulting in a denial-of-service (DoS) condition.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but recommends reviewing firewall and VPN logs for unexpected reloads, service interruptions, or suspicious HTTP requests targeting SSL VPN services.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The primary vulnerability affects network infrastructure devices (Cisco ASA/FTD) rather than endpoints. |
| Network Visibility | High | Exploitation involves sending crafted HTTP requests to SSL VPN services, which should be visible in network and firewall logs. |
| Detection Difficulty | Moderate | Detecting the crafted HTTP requests requires specific knowledge of the exploit payload, but monitoring for unexpected device reloads and service interruptions is straightforward. |
Required Log Sources
- Firewall logs
- VPN logs
- Network flow data
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for unexpected reload events or service interruptions on Cisco ASA and FTD devices. | Firewall system logs, SNMP traps, device availability monitoring. | Impact | Low, as unexpected reloads are typically indicative of instability or attack. |
| Hunt for suspicious or malformed HTTP requests targeting SSL VPN listen sockets on perimeter firewalls. | Firewall access logs, full packet capture, IDS/IPS alerts. | Initial Access | Medium, as legitimate but unusual client behavior might trigger anomalies. |
Control Gaps
- Network IPS signatures may not detect the specific crafted HTTP request if rules are not updated.
- Availability monitoring may not distinguish between routine maintenance reboots and attack-induced reloads.
Key Behavioral Indicators
- Unexpected firewall reload events
- Service interruptions on SSL VPN endpoints
- Anomalous HTTP requests targeting SSL VPN services
False Positive Assessment
Low
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Identify internet-accessible Cisco Secure Firewall ASA and FTD systems providing Remote Access SSL VPN services.
- If applicable, disable or restrict access to SSL VPN, IKEv2 Remote Access VPN (with client services), or Zero Trust Network Access features on affected Cisco devices until patches can be applied.
Infrastructure Hardening
- Upgrade affected Cisco ASA and FTD instances to the fixed versions listed in the advisory.
- Ensure perimeter devices and VPN gateways are included in vulnerability management and patch management programs.
- Consolidate, monitor, and defend internet gateways to reduce exposure.
User Protection
- Apply updates for AMD Ryzen Master, PDM, and Vitis software as they become available.
- Update GitLab installations to versions 19.0.6, 19.1.4, or 19.2.2 or later.
- Update WebPros Plesk to version 18.0.79.6, 18.0.80.2, or later to mitigate CVE-2026-64639.
Security Awareness
- Consider notifying IT staff about the active exploitation of the Cisco SSL VPN vulnerability and the urgency of patching.
- Encourage administrators to review vendor advisories regularly as part of existing awareness programs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
