CISCO: 📅 Published on Sep 16, 2026

CISCO Security Advisory

Published Date: Sep 16, 2026

CVE: CVE-2026-20242

Advisory Summary

🛑 Cisco Secure Firewall FMC Java Deserialization RCE (Critical)
Cisco disclosed a Critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that can be exploited by an unauthenticated, remote attacker to achieve arbitrary command execution as root.

• CVE: CVE-2026-20242
• Severity: Critical (Remote Code Execution, root impact)

• The flaw is caused by insecure deserialization of a user-supplied Java byte stream.
• Exploitation requires sending a crafted serialized Java payload to a specific TCP port on an affected FMC device.
• The payload must be delivered from a host that is present in the “External Database Access” allow list configured on the FMC.

• Attacker prerequisites: adversary must control a host in the external database access list.
• Exposure reduction: if the FMC management interface is not reachable from the public internet, the effective attack surface is reduced—but internal exposure could still exist.

• Arbitrary command execution
• Privilege escalation to root
• Potential full device compromise, persistence, and downstream impact on firewall policy enforcement.

• ✅ Cisco released software updates that address the vulnerability.
• ❌ No workarounds are available for this issue—patching is the primary remediation.

📌 Action checklist for IT & SecOps
1. Identify affected FMC versions and confirm whether External Database Access is configured.
2. Inventory and validate every host in the external database access list—treat them as potential threat entry points.
3. Upgrade FMC to the patched release provided by Cisco (no workaround path).
4. Apply network controls to restrict access to the relevant TCP port(s) and ensure FMC management isn’t exposed more broadly than required.
5. Review logs for any signs of unexpected inbound serialized payloads targeting FMC listeners.

⬇️