CVE-2026-20341

Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.1Critical EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether you run Cisco Secure Firewall Management Center and identify who has administrator access to managed Cisco FTD devices.
Remove unnecessary administrator accounts, rotate credentials for former staff or vendors, and require strong multi-factor login protection where available.
No fixed version has been published in the available findings; obtain Cisco’s remediation guidance and apply the vendor-provided fixed release as soon as one is available.
Review management-system activity for unfamiliar administrator logins, configuration changes, or commands sent between paired systems.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker could exploit this vulnerability by sending crafted sftunnel remote procedure calls (RPCs). A successful exploit could allow the attacker to gain root privileges on a device that is running Cisco Secure FMC Software and its high-availability peer. To exploit this vulnerability, the attacker must have valid administrative credentials on a managed Cisco FTD device.

In plain language

Written by AI from the record

Cisco Secure Firewall Management Center users should treat this as urgent: a public attack method can give someone with managed-device administrator access complete control of the system.

CWE-502 insecure deserialization in Cisco Secure Firewall Management Center sftunnel RPCs enables authenticated remote root command execution from valid administrative credentials on a managed Cisco FTD device.

If you're affected

Full firewall-management takeover
Security policy changes
Network exposure
High-availability peer compromise
Operational disruption

What is it

This is a flaw in the management connection used by Cisco Secure Firewall Management Center to communicate with other firewall components. It is like a person with a master key being able to hand the building manager a forged instruction that is accepted as real, giving them control of the whole building and potentially its backup location.

Who is affected

This matters to you if you run Cisco Secure Firewall Management Center to manage Cisco FTD devices. It is only a risk if an attacker already has valid administrator credentials on a managed Cisco FTD device.

How urgent is it

A public exploit is available, so attackers who obtain the required administrator access have a ready-made route to take full control. Treat this as a red-priority issue: reduce administrator access now and obtain Cisco’s fix guidance immediately; it is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do — in detail

Confirm deployment and exposure by inventorying Cisco Secure Firewall Management Center instances, their high-availability peers, and every managed Cisco FTD device. Identify all accounts with valid administrative credentials on managed FTD devices, especially shared, vendor, dormant, or recently departed-user accounts.

No fixed version or supported release branch has been provided in the available findings, so there is no verified target version or upgrade path to recommend yet. Request Cisco’s advisory and remediation release information, then follow its documented upgrade sequence and compatibility guidance for FMC, managed FTD devices, and any high-availability pair.

While patching is unavailable or delayed, disable or remove unneeded managed-FTD administrator accounts, rotate privileged credentials, restrict management connectivity to trusted administration networks, and review access controls around the sftunnel management path. Monitor administrator authentication activity, newly created or changed privileged accounts, unexpected FMC or FTD configuration changes, and unusual activity between high-availability peers. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

Severity is CVSS 9.1 (Critical): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The weakness is CWE-502, insecure deserialization of untrusted data in sftunnel inter-device RPC handling. An authenticated remote attacker with valid administrative credentials on a managed Cisco FTD device can send crafted sftunnel RPCs and gain root privileges on Cisco Secure Firewall Management Center and its high-availability peer. A public exploit is available; CISA KEV does not list this CVE. EPSS is 0.4% (38th percentile) with a flat trend; this is a prediction, not evidence of observed exploitation. Press attention is new and attributed to exploitation, but the findings do not independently confirm exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-18Record updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Secure Firewall Management Center (FMC)Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable