CVE-2026-20341 describes a critical vulnerability in Cisco Secure FMC Software's sftunnel inter-device communication protocol. The vulnerability is due to insecure deserialization of untrusted data over the sftunnel management connection. An attacker with valid administrative credentials on a managed Cisco FTD device can exploit this by sending crafted sftunnel RPCs, potentially gaining root privileges on the targeted device and its high-availability peer. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation grants an attacker root privileges on devices running Cisco Secure FMC Software and its high-availability peers, enabling full control over the affected systems. This can lead to complete compromise of the device, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires valid administrative credentials, limiting administrative access and monitoring for suspicious activity on managed Cisco FTD devices is advisable until an official fix is available.