CVE-2026-20242: Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Hodnocení závažnosti

9.8 CVSS 3.1 cisco

útok odkudkoli z internetu bez přípravy bez přihlášení bez zásahu uživatele

dopad plný únik dat úplná změna dat úplný výpadek

přesah dopad jen na zranitelnou součást

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

16. 9. 2026 18:00

SPOJENO PŘES CVE Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port…

EPSS 0.01 CVSS 8.1 CVE-2026-20242 Cisco US

tg: zranitelnost

16. 9. 2026 18:00 · Cisco PSIRT · Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability 16. 9. 2026 · zachyceno 17. 9. 2026 02:00 · Zero Day Initiative · ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability