Threats Tagged 'cve-2026-20340'

CVE-2026-20340 is a high-severity vulnerability in Cisco Secure FMC Software that allows an authenticated remote attacker with Security Analyst role or higher to execute arbitrary commands as root. The issue arises from unsecured deserialization of user-controlled data in the web management interface. Exploitation requires valid credentials and involves sending a crafted HTTP payload that can be saved and executed on the underlying OS with root privileges.

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP payload. A successful exploit could allow the attacker to save the crafted payload and then execute it on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (read-only).