Loading story…
Cisco disclosed multiple vulnerabilities in the sftunnel communication component of Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD). CVE-2026-20324, rated CVSS 9.9, is a missing-authorization flaw that lets an attacker controlling or hijacking a registered sftunnel peer write arbitrary files and execute commands as root on FMC, potentially compromising the centralized management plane. Cisco reported no known malicious exploitation when it disclosed the issue.
Cisco also patched CVE-2026-20295 and CVE-2026-20323, which are associated with improper certificate validation (CWE-295). CVE-2026-20295 is network-accessible without authentication or user interaction and can cause a high-impact denial of service. Organizations should upgrade FMC and FTD to Cisco's fixed releases, as no workaround is available for the root-RCE issue, and should investigate anomalous sftunnel peer registrations or policy deployments while segmenting and monitoring the firewall management plane.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco published advisory cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3 and patches for CVE-2026-20295 and CVE-2026-20323 affecting Firepower Management Center and Firepower Threat Defense. CVE-2026-20295 is a CWE-295 issue with network-reachable, low-complexity exploitation and high availability impact.
Cisco disclosed CVE-2026-20324, a CVSS 9.9 missing-authorization vulnerability in FMC sftunnel communications. An attacker controlling or hijacking a registered sftunnel peer could write arbitrary files and execute commands as root; Cisco said it was unaware of malicious exploitation and that no workaround exists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed multiple vulnerabilities affecting **Secure Firewall Management Center (FMC)**, **Secure Firewall Threat Defense (FTD)**, and **Adaptive Security Appliance (ASA)** software, including a **remote code execution** flaw tied to RADIUS handling in FMC and a separate **authentication bypass** issue in on-premises FMC. Additional advisories describe a **path traversal** vulnerability in FMC and FTD, expanding the risk to core firewall management and security enforcement platforms used in enterprise environments. The broader set of advisories also includes a **Snort deep inspection bypass** in FTD, a **TLS/Snort 3 denial-of-service** issue, a **SAML reflected cross-site scripting** flaw affecting ASA and FTD, a **VPN web services client-side request smuggling** vulnerability, and a **Lua code injection** bug in ASA and FTD. Taken together, the disclosures show that Cisco firewall products were exposed to weaknesses spanning **code execution, access control, traffic inspection evasion, denial of service, and web interface exploitation**, creating multiple paths for attackers to disrupt defenses or gain elevated access if affected systems remain unpatched.
Jul 12, 2026
Cisco released security updates for two **maximum-severity** vulnerabilities in *Cisco Secure Firewall Management Center (FMC)* that can be exploited remotely by **unauthenticated** attackers via crafted HTTP requests to the web-based management interface. The issues include an **authentication bypass** (**CVE-2026-20079**) that can lead to **root access** on the underlying operating system and a **remote code execution** flaw (**CVE-2026-20131**) that allows execution of arbitrary Java code as root on unpatched systems. The Canadian Centre for Cyber Security highlighted Cisco’s advisories and urged administrators to review Cisco guidance and apply updates, noting impact to **Cisco Security Cloud Control (SCC) Firewall Management** and **Cisco Secure FMC** across versions. Cisco stated its PSIRT had **no evidence of active exploitation** and no public PoC at the time of publication, while also issuing fixes for additional vulnerabilities (including multiple high-severity issues) across Cisco firewall management and firewall platforms.
Jun 29, 2026
Cisco disclosed active zero-day exploitation of **CVE-2026-20316** in **Secure Firewall Management Center (FMC)**, a static credential flaw caused by built-in credentials for a low-privilege account. The company warned that attackers could use the issue to gain unauthorized access to vulnerable FMC appliances and potentially chain it with other, undisclosed FMC vulnerabilities to escalate privileges. Cisco released hotfixes for affected Secure FMC versions **7.0, 7.2, 7.4, 7.6, 7.7, and 10.0**, said no workaround is available, and advised customers to check logs for the indicator `/var/tmp/license.tmp` and rotate credentials, keys, and certificates if compromise is suspected. CISA added the vulnerability to its **Known Exploited Vulnerabilities** catalog, underscoring that the flaw is being exploited in the wild and warning that compromise of FMC could let attackers change firewall policies, disrupt monitoring, and potentially move laterally across enterprise environments. Organizations were urged to identify exposed FMC deployments, apply Cisco's fixes, restrict access to management interfaces, and review logs and configurations for evidence of unauthorized access. Cisco also updated guidance for a separate FMC authentication bypass flaw, **CVE-2026-20079**, but said it has no evidence that issue has been exploited.
Aug 25, 2026