{"id":"CVE-2026-20242","aliases":["EUVD-2026-81109","GHSA-mgpv-rwhr-9mx2"],"status":"published","title":"Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability","description":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as\u0026nbsp;root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.\r\nNotes:\r\n\r\nThis vulnerability can be exploited only by an attacker who has control of a host in the external database access list.\r\nIf the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00889,"percentile":0.59814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-09-16T20:08:27Z","modified":"2026-09-18T04:17:34Z","products":[{"vendor":"cisco","product":"cisco secure firewall management center (fmc)"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-javarce-y2NypXwk"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20242"},{"url":"https://github.com/advisories/GHSA-mgpv-rwhr-9mx2"}],"sources":{"cve":[{"id":"CVE-2026-20242","title":"Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability","description":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as\u0026nbsp;root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.\r\nNotes:\r\n\r\nThis vulnerability can be exploited only by an attacker who has control of a host in the external database access list.\r\nIf the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","status":"published","published":"2026-09-16T20:08:27.904Z","modified":"2026-09-18T03:55:57.449Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:35:44.571002Z"}],"euvd":[{"id":"EUVD-2026-81109","description":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as\u0026nbsp;root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.\r\nNotes:\r\n\r\nThis vulnerability can be exploited only by an attacker who has control of a host in the external database access list.\r\nIf the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","status":"published","published":"2026-09-16T20:08:27Z","modified":"2026-09-18T03:55:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:09.684322Z"}],"ghsa":[{"id":"GHSA-mgpv-rwhr-9mx2","title":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management...","description":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as\u0026nbsp;root on an affected device.\n\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.\nNotes:\n\nThis vulnerability can be exploited only by an attacker who has control of a host in the external database access list.\nIf the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","status":"published","published":"2026-09-16T21:32:45Z","modified":"2026-09-16T21:32:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:12:02.095044Z"}],"nvd":[{"id":"CVE-2026-20242","description":"A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as\u0026nbsp;root on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root.\r\nNotes:\r\n\r\nThis vulnerability can be exploited only by an attacker who has control of a host in the external database access list.\r\nIf the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.","status":"published","published":"2026-09-16T20:17:22.697Z","modified":"2026-09-18T04:17:34.083Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:48.630594Z"}]}}