CVE-2026-20324: Missing Authorization in Cisco Cisco Secure Firewall Management Center (FMC)
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
AI Analysis
Technical Summary
This vulnerability exists due to incorrect permissions granted to registered sftunnel peers in Cisco Secure Firewall Management Center (FMC) software. An authenticated remote attacker who is a valid sftunnel peer or who can hijack the sftunnel communication can send commands to write arbitrary files to the device's disk. These files can be executed with root privileges, enabling arbitrary command execution as root. Exploitation requires valid user credentials on the affected device. The vulnerability affects numerous specific versions of Cisco FMC software in the 7.x and 10.x series.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full system compromise, including control over the firewall management center, potentially impacting network security and operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to valid user credentials and registered sftunnel peers to trusted entities only. Monitor for unauthorized sftunnel connections and consider additional network segmentation to limit exposure.
CVE-2026-20324: Missing Authorization in Cisco Cisco Secure Firewall Management Center (FMC)
Description
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
CVSS v3.1
Score 9.9critical
Affected software
Cisco
Cisco Secure Firewall Management Center (FMC)
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists due to incorrect permissions granted to registered sftunnel peers in Cisco Secure Firewall Management Center (FMC) software. An authenticated remote attacker who is a valid sftunnel peer or who can hijack the sftunnel communication can send commands to write arbitrary files to the device's disk. These files can be executed with root privileges, enabling arbitrary command execution as root. Exploitation requires valid user credentials on the affected device. The vulnerability affects numerous specific versions of Cisco FMC software in the 7.x and 10.x series.
Potential Impact
Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full system compromise, including control over the firewall management center, potentially impacting network security and operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to valid user credentials and registered sftunnel peers to trusted entities only. Monitor for unauthorized sftunnel connections and consider additional network segmentation to limit exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2025-10-08T11:59:15.411Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaaf94155bf5e2cf51b9352
Added to database: 09/16/2026, 20:17:05 UTC
Last enriched: 09/16/2026, 20:33:02 UTC
Last updated: 09/17/2026, 03:01:24 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.