CVE-2026-20323

CVE-2026-20323 is an improper certificate validation flaw (CWE-295) in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software, arising from improper management of the TLS certificate used for the sftunnel management connection. An unauthenticated, adjacent attacker can trigger it by connecting to the sftunnel port with a crafted TLS certificate, but the attack succeeds only if the sftunnel connection is already down or if the attacker can disrupt it long enough to complete the impersonation. A successful exploit lets the attacker register as the sftunnel peer and obtain manager-role access, which is equivalent to root on the device. Any organization running a paired Cisco Secure FMC/FTD deployment is potentially affected, though exploitation requires network adjacency to the sftunnel channel. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and exploitation has not been reported in the wild.

What to do: Upgrade both Secure FMC and Secure FTD to the fixed releases identified in Cisco's security advisory (version numbers are not specified in this dataset). Until patched, restrict access to the sftunnel management port via ACLs so only the legitimate FMC/FTD peers can reach it, and monitor for sftunnel connection drops or unexpected peer registrations, since exploitation depends on the tunnel being down or disruptable.