CVE-2026-20323 – Cisco Secure Firewall Management Center (FMC)

Cisco has released an update for Secure Firewall Management Center (FMC) that fixes seven vulnerabilities. Four are Critical and three are High. Most of them give an attacker root access to the system that manages the organization's firewalls. CVE-2026-20324 has a CVSS score of 9.9, Critical severity, and lets an authenticated attacker write a malicious file through the sftunnel inter-device protocol that then runs as root. CVE-2026-20242 has a CVSS score of 9.8, Critical severity. It is an insecure deserialization flaw in the External Database Access feature that lets an unauthenticated remote attacker run commands as root from a host on the external database access list. CVE-2026-20341 has a CVSS score of 9.1, Critical severity, and lets an attacker who holds admin credentials on a managed FTD device gain root on the FMC and its high-availability peer through crafted sftunnel RPCs. CVE-2026-76420 has a CVSS score of 9.0, Critical severity. A misconfigured AJP connector lets an unauthenticated attacker impersonate a peer device, run commands as root, and take full control of the FMC REST APIs.

The three High-severity flaws widen the risk. CVE-2026-20340 has a CVSS score of 8.8, High severity, and lets any user with the read-only Security Analyst role run code as root through a crafted HTTP payload. CVE-2026-20323 has a CVSS score of 8.3, High severity, and lets an adjacent attacker with a crafted TLS certificate impersonate an sftunnel peer with root-equivalent access. CVE-2026-20343 has a CVSS score of 7.5, High severity. An API with no authentication lets remote attackers download sensitive files and fill the disk until the device stops responding. Because FMC controls policy for every managed firewall, compromising it puts the entire network perimeter at risk.