CVE-2026-20044
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root. This is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this by sending crafted input to the system CLI.
Risk Assessment
The risk to the organization is full compromise of the FMC device, potentially leading to loss of control over security management and possibly the entire firewall infrastructure.
Recommendation
Apply Cisco-provided patches immediately and restrict CLI access to trusted administrators only. Also monitor logs for unusual activities.
Other vulnerabilities in Cisco Secure Firewall Management Center
See all- CVE-2026-20242Critical
Vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) allows an unauthenticated remote attacker to execute arbitrary commands as root. It is due to insecure deserialization of a user-supplied Java byte stream from a host in the external database access list.
- CVE-2026-20079CriticalActively exploited
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software allows an unauthenticated, remote attacker to bypass authentication and execute script files to obtain root access to the underlying operating system. This is due to an improper system process created at boot time.
Original NVD description (English source)
A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root. This vulnerability is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this vulnerability by sending crafted input to the system CLI of the affected device. A successful exploit could allow the attacker to run arbitrary commands or code as root, even when the system is in lockdown mode. To exploit this vulnerability, the attacker must have valid administrative credentials.