CVE-2026-20340

Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.18.8High EPSS percentile51st0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your organization runs Cisco Secure Firewall Management Center and identify accounts assigned the Security Analyst role or higher.
No fixed version has been published in the available findings; ask Cisco or your support provider for the official remediation and deployment timeline.
Until a fix is available, restrict access to the management interface to trusted administrator networks and remove unnecessary Security Analyst accounts.
Review management-system logs for unusual account activity, unexpected commands, or unfamiliar configuration changes.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).

In plain language

Written by AI from the record

Cisco Secure Firewall Management Center has a serious flaw that lets a logged-in low-privilege user take full control; treat it as urgent, but no vendor fix information is available yet.

Authenticated remote root command execution in Cisco Secure Firewall Management Center through insecure deserialization of attacker-controlled web-management data, requiring Security Analyst-or-higher credentials.

If you're affected

Full firewall management takeover
Network policy changes
Security monitoring disruption
Customer data exposure
Operational outage

What is it

This is a flaw in the system used to manage firewall security settings. It is like giving someone with a visitor badge a way to obtain the building master key: a low-level account can be turned into complete control of the underlying system.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center to manage your firewall environment. An attacker must already have a valid account with at least the Security Analyst role, so it is only a risk after they can sign in to the management system.

How urgent is it

A public exploit is available, meaning attackers have a ready-made starting point for abusing this flaw once they obtain a suitable account. Treat this as a red-priority issue: reduce management access and unnecessary user privileges now while awaiting Cisco’s fix guidance.

What to do — in detail

Confirm exposure by inventorying Cisco Secure Firewall Management Center deployments and reviewing local user, directory-backed, and service accounts for Security Analyst-or-higher access. The available findings do not identify any fixed release or supported branch target, so obtain an official advisory and upgrade path from Cisco before scheduling remediation.

If patching is delayed, limit the web-management interface to a dedicated administrator network, require trusted access paths, and disable or downgrade Security Analyst accounts that are not required. Review authentication events, web-management requests, privilege changes, configuration changes, and operating-system command activity for unusual behavior; preserve relevant logs for investigation. This CVE is not listed in CISA KEV, so no CISA due date applies from the available findings.

Technical context

CVE-2026-20340 is rated CVSS 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is CWE-502 insecure deserialization: an authenticated remote user submits a crafted HTTP payload through the web-management interface, saves it, and can execute arbitrary commands as root on the underlying operating system. A public exploit is available. CISA KEV does not list this CVE. EPSS predicts a 0.7% likelihood (51st percentile) and the trend is flat; this is predictive scoring, not confirmation of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS51st

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 51st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 2 days, from the signal feeds we watch.

2026-09-18Record updatedrecord updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable