Critical [CVE-2026-20242] Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
This critical-severity Cisco advisory covers CVE-2026-20242 affecting Secure Firewall Management Center (FMC) Appliances.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device.
A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.
Notes:
- This vulnerability can be exploited only by an attacker who has control of a host in the external database access list.
- If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories.
Affected product named by the advisory: Secure Firewall Management Center (FMC) Appliances.
- Scope: This vulnerability affects Cisco Secure FMC Software if External Database Access is enabled and there is at least one host configured in the access list. For additional information, see the Enabling External Access to the Database section of the Firepower Management Center Configuration Guide.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable External Database Access until a fixed software release is deployed.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.