CVE-2026-20001 is an SQL injection vulnerability identified in the REST API of Cisco Secure Firewall Management Center (FMC) software. This vulnerability stems from inadequate sanitization and validation of user-supplied input parameters within API requests. An attacker who has authenticated access with roles such as Administrator, Security approver, Access admin, or Network admin can craft malicious API requests that inject SQL commands into the backend database queries. The injection flaw allows the attacker to bypass intended query logic and retrieve sensitive data from the FMC's database, including potentially confidential firewall management information. Additionally, the attacker may read certain files on the underlying operating system, increasing the risk of information disclosure beyond the database. The vulnerability affects a broad range of FMC versions from 7.0.0 through 7.6.2.4, indicating a long-standing issue across multiple releases. Exploitation requires valid credentials but no further user interaction, and the attack vector is network-based via the REST API. The CVSS v3.1 base score is 6.5, reflecting medium severity due to the high confidentiality impact but limited integrity and availability impact. No public exploit code or active exploitation has been reported to date. The vulnerability highlights the critical need for robust input validation in API endpoints, especially in security management products that control network defenses.

The primary impact of this vulnerability is unauthorized disclosure of sensitive information stored within the Cisco FMC database and certain operating system files. This can lead to exposure of firewall policies, network configurations, user credentials, and other critical security data, potentially aiding further attacks or lateral movement within an organization. Since FMC is widely deployed in enterprise and government networks to manage firewall policies and security posture, compromise could undermine network defenses and trust in security controls. Although the vulnerability does not allow modification or deletion of data (no integrity or availability impact), the confidentiality breach alone can have severe consequences including regulatory non-compliance, intellectual property theft, and increased risk of targeted attacks. Organizations relying on Cisco FMC for perimeter and internal network security management are at risk, especially if attackers gain access to privileged accounts. The requirement for valid credentials limits exploitation to insiders or attackers who have already compromised user accounts, but the ease of remote exploitation via the REST API increases the attack surface. The absence of known exploits in the wild currently reduces immediate risk but does not eliminate the threat, as attackers may develop exploits in the future.

1. Apply the latest security patches and updates from Cisco as soon as they become available for the affected FMC versions to remediate the vulnerability. 2. Enforce strict access controls and multi-factor authentication (MFA) for all accounts with Administrator, Security approver, Access admin, or Network admin roles to reduce the risk of credential compromise. 3. Monitor and audit REST API access logs for unusual or suspicious activity indicative of attempted SQL injection or unauthorized data access. 4. Implement network segmentation and firewall rules to restrict REST API access only to trusted management networks and authorized personnel. 5. Conduct regular security assessments and penetration testing focused on API endpoints to identify and remediate input validation weaknesses. 6. Use web application firewalls (WAFs) or API gateways with SQL injection detection and prevention capabilities to provide an additional layer of defense. 7. Educate administrators and security teams about the risks of SQL injection and the importance of credential security to prevent insider threats. 8. Consider temporary disabling or limiting REST API functionality if feasible until patches are applied, especially in high-risk environments. 9. Review and minimize the number of users assigned privileged roles to reduce the attack surface. 10. Maintain up-to-date backups and incident response plans to quickly recover from any potential compromise.