Critical Cisco Secure Firewall Management Vulnerability Enables Remote Code Execution

Cisco recently disclosed a critical vulnerability in its Secure Firewall Management Center (FMC) software, earning a perfect CVSS score of 10.0.

This flaw lets unauthenticated remote attackers run arbitrary code with root privileges, potentially wiping out entire enterprise networks.

Discovered by Keane O’Kelley of Cisco’s Advanced Security Initiatives Group (ASIG) during internal testing, the issue stems from insecure deserialization of user-supplied Java byte streams in the web management interface.

Attackers send a crafted serialized Java object, which the system parses without validation, bypassing authentication and granting root access for full control.

No public exploits exist yet, per Cisco’s Product Security Incident Response Team (PSIRT). But with the management interface often exposed, unpatched systems face a high risk.

Affected Products and CVE Details

This hits Cisco Secure FMC Software and Security Cloud Control (SCC) Firewall Management, regardless of device config. ASA and Threat Defense (FTD) software are safe.

CVE-2026-20131 is a critical vulnerability with a CVSS score of 10.0, classified as a Remote Code Execution flaw tied to CWE-502.

This high-severity issue allows attackers to execute arbitrary code remotely, posing severe risks to affected systems.

Insecure deserialization trusts external data blindly. A malicious payload tricks the FMC into executing commands as root, enabling data theft, ransomware, or backdoor installs.

Public internet exposure amps the danger; internal-only access lowers it slightly. SCC users get auto-patches via SaaS, no action needed.

No workarounds exist. Patch now via Cisco’s March 2026 Secure Firewall Software Security Advisory. Use the Cisco Software Checker for upgrade paths.

Network teams must prioritize this max-severity flaw. Delays invite threat actors to weaponize it. Check configs, scan exposures, and verify patches. Stay vigilant, deserialization bugs like this fuel zero-days.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Critical Cisco Secure Firewall Management Vulnerability Enables Remote Code Execution appeared first on Cyber Security News.