Skip to content
OpenAdvisories
Critical · 10.0 Known exploited · Ransomware Public exploit CVE-2026-20131 EUVD-2026-9444GHSA-r229-mj76-g2qx

Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability

Published Mar 4, 2026 · Updated Aug 14, 2026 · Assigned by cisco

Vendor: Cisco Product: Cisco Secure Firewall Management Center (FMC) Category: Network devices

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Affected products

VendorProductAffectedFixed
Cisco Cisco Secure Firewall Management Center (FMC) 7.0.0, 7.0.0.1, 7.0.1, 7.1.0, 6.4.0.13, 7.0.1.1, 6.4.0.14, 7.1.0.1, 7.0.2, 6.4.0.15, 7.2.0, 7.0.2.1, 7.0.3, 7.1.0.2, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 6.4.0.16, 7.3.0, 7.2.2, 7.3.1, 7.2.3, 7.1.0.3, 7.2.3.1, 7.2.4, 7.0.6, 7.2.4.1, 7.2.5, 7.3.1.1, 7.4.0, 6.4.0.17, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.4.1.1,… —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References