CVE-2026-20242
CVE-2026-20242: 1 tracked advisory record across Cisco. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Cisco
1 advisory- Advisory severityCritical9.8
Critical [CVE-2026-20242] Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
cisco-sa-fmc-javarce-y2NypXwkSource published Source updated
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root. Notes: - This vulnerability can be exploited only by an attacker who has control of a host in the external database access list. - If the FMC management…
- Affected products in this advisory
- Secure Firewall Management Center (FMC) Appliances
- Source-reported affected versions
- Scope: This vulnerability affects Cisco Secure FMC Software if External Database Access is enabled and there is at least one host configured in the access list. For additional information, see the Enabling External Access to the Database section of the Firepower Management Center Configuration Guide.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable External Database Access until a fixed software release is deployed.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.