CVE-2026-20340

Cisco Secure Firewall Management Center (FMC) Software contains a flaw (CWE-502) caused by unsecured deserialization of user-controlled data in the web management interface. An attacker who holds valid credentials for an account with at least the read-only Security Analyst role can authenticate and send a crafted HTTP payload, which is saved by the device and can then be executed on the underlying operating system. Successful exploitation yields arbitrary command execution at the root privilege level, giving full control of the FMC appliance and, by extension, the firewall policies it manages. Any organization running Cisco Secure FMC Software is affected, with the practical risk limited to attackers who can reach the management interface and obtain a low-privileged account. As of now, the flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Upgrade FMC to the fixed release identified in Cisco's security advisory. Restrict access to the FMC web management interface to trusted management networks, audit accounts holding the Security Analyst or higher roles, and review saved/scheduled configurations and system logs for unexpected payloads or command execution as indicators of prior exploitation.