CVE-2026-20344
HighCVSS 8.8Summary
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack. The attacker must have a valid account with the role of Security Approver, Access Admin, or Network Admin. The issue is due to insufficient validation of user-supplied input.
Risk Assessment
A successful exploit could allow the attacker to obtain any data from the database, obtain session credentials of an authenticated Administrator, and take actions with administrative privileges, potentially leading to full system compromise.
Recommendation
Apply the patches provided by Cisco immediately and restrict access to the management interface to trusted users and networks only.
Other vulnerabilities in Cisco Secure FMC Software
See all- CVE-2026-76413High
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques.
- CVE-2026-76412High
A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device and using the remote diagnostics debugger to grant a user elevated privileges.
- CVE-2026-20343High
A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. The issue exists because a critical API lacks authentication.
- CVE-2026-20342High
A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. The issue exists because user input is not being sanitized. The attacker must have valid credentials with at least the role of Security Analyst (read-only).
- CVE-2026-20340High
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. The issue is due to unsecured deserialization of web-management user-controlled data. The attacker must have valid credentials with at least the role of Security Analyst (read-only).
- CVE-2026-20341Critical
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker can send crafted sftunnel RPCs to gain root privileges on the device and its high-availability peer. Valid administrative credentials on a managed Cisco FTD device are required.
- CVE-2026-20324Critical
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker can hijack the sftunnel connection or be a valid peer and send a command to write a malicious file that is executed with root privileges. Valid user credentials on the device are required.
- CVE-2026-20003Medium
A vulnerability in the REST API of Cisco Secure FMC Software allows SQL injection attacks. It is due to inadequate validation of user-supplied input. An authenticated attacker can send crafted requests to gain read access to the database and read certain files on the underlying OS.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.