cisco-sa-fmc-javarce-y2NypXwkCriticalCVSS 9.8

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Published
September 16, 2026
Last Modified
September 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-20242 →

📋 Description

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.

This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.

Notes:

This vulnerability can be exploited only by an attacker who has control of a host in the external database access list. If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP"]. In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN"].

CVE-2026-20242 — Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability (CVSS 3.1 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

🎯 Affected products70

  • Cisco Secure Firewall Management Center (FMC)
  • Cisco Secure Firewall Management Center (FMC) Appliances
  • Cisco Secure Firewall Management Center (FMC) 10.0.0
  • Cisco Secure Firewall Management Center (FMC) 10.0.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.0
  • Cisco Secure Firewall Management Center (FMC) 7.0.0.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.1.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.2
  • Cisco Secure Firewall Management Center (FMC) 7.0.2.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.3
  • Cisco Secure Firewall Management Center (FMC) 7.0.4
  • Cisco Secure Firewall Management Center (FMC) 7.0.5
  • Cisco Secure Firewall Management Center (FMC) 7.0.6
  • Cisco Secure Firewall Management Center (FMC) 7.0.6.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.6.2
  • Cisco Secure Firewall Management Center (FMC) 7.0.6.3
  • Cisco Secure Firewall Management Center (FMC) 7.0.7
  • Cisco Secure Firewall Management Center (FMC) 7.0.8
  • Cisco Secure Firewall Management Center (FMC) 7.0.8.1
  • Cisco Secure Firewall Management Center (FMC) 7.0.9
  • Cisco Secure Firewall Management Center (FMC) 7.2.0
  • Cisco Secure Firewall Management Center (FMC) 7.2.0.1
  • Cisco Secure Firewall Management Center (FMC) 7.2.1
  • Cisco Secure Firewall Management Center (FMC) 7.2.10
  • Cisco Secure Firewall Management Center (FMC) 7.2.10.1
  • Cisco Secure Firewall Management Center (FMC) 7.2.10.2
  • Cisco Secure Firewall Management Center (FMC) 7.2.11
  • Cisco Secure Firewall Management Center (FMC) 7.2.2
  • Cisco Secure Firewall Management Center (FMC) 7.2.3
  • +40 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable External Database Access until a fixed software release is deployed. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (8)