CVE Tools
Sign in

CVE-2026-20242

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Published: Sep 16, 2026Updated: Sep 18, 2026 Sources: CVE List NVDCWE-502
9.8CRITICAL
NVD MITRE
EPSS Score
0.6%
Top 50.8%
CISA KEV
Not in KEV
Exploits
0 Known
Remediation
No Fix Available
Self-Check
Not available

Description

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root. Notes: This vulnerability can be exploited only by an attacker who has control of a host in the external database access list. If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

In plain language

AI Act now

A critical flaw in Cisco Secure Firewall Management Center (FMC) can let a hostile approved database host take over the device, so businesses using that feature should act now.

Executive summary

Unauthenticated remote code execution as root is possible through insecure Java deserialization in FMC's External Database Access feature when an attacker controls a host on its external database access list.

If affected, business impact
Full FMC takeoverFirewall policy changesNetwork security disruptionSensitive configuration exposure

What to do now

  1. Check whether Cisco Secure Firewall Management Center (FMC) uses External Database Access and identify every host on its approved database access list.
  2. Confirm that only trusted, controlled hosts remain on that list; remove any unnecessary or untrusted entries.
  3. Restrict access to the FMC management interface and the affected service port so only required internal hosts can reach it.
  4. No fixed version is currently available; ask Cisco or your support provider for the vendor-approved remediation and apply it when released.
May need vendor / contractor work

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-502

Affected Products

Cisco
commercial·USaka cisco systems inc., cisco systems
Cisco Secure Firewall Management Center (FMC)
Networking Infrastructure

Exploitability

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Is your org exposed to CVE-2026-20242?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

3 techniques
Execution
Initial Access
View detailed technique mapping

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-javarce-y2NypXwk
sec.cloudapps.cisco.com
News mentions
1

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-20242 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows