Vulnerability Intelligence Report

Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability

CVE-2026-20324

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerability by hijacking the sftunnel communication connection or being a valid registered sftunnel peer and sending an sftunnel command to write a malicious file to the disk of an affected device. A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

No Active Exploit Signals

CVSS Base Score

9.9

CRITICAL

Exploitability:3.2

Impact Score:6.1

EPSS Probability:0.44%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

CWE-862 ↗Missing Authorization

Affected Products & Versions

Vendor	Product	Affected Versions
Cisco	Cisco Secure Firewall Management Center (FMC)	7.0.0 (affected), 7.0.0.1 (affected), 7.0.1 (affected), 7.0.1.1 (affected), 7.0.2 (affected), 7.2.0 (affected), 7.0.2.1 (affected), 7.0.3 (affected), 7.2.0.1 (affected), 7.0.4 (affected), 7.2.1 (affected), 7.0.5 (affected), 7.3.0 (affected), 7.2.2 (affected), 7.3.1 (affected), 7.2.3 (affected), 7.2.3.1 (affected), 7.2.4 (affected), 7.0.6 (affected), 7.2.4.1 (affected), 7.2.5 (affected), 7.3.1.1 (affected), 7.4.0 (affected), 7.0.6.1 (affected), 7.2.5.1 (affected), 7.4.1 (affected), 7.2.6 (affected), 7.4.1.1 (affected), 7.0.6.2 (affected), 7.2.7 (affected), 7.2.5.2 (affected), 7.3.1.2 (affected), 7.2.8 (affected), 7.6.0 (affected), 7.4.2 (affected), 7.2.8.1 (affected), 7.0.6.3 (affected), 7.4.2.1 (affected), 7.2.9 (affected), 7.0.7 (affected), 7.7.0 (affected), 7.4.2.2 (affected), 7.2.10 (affected), 7.6.1 (affected), 7.4.2.3 (affected), 7.0.8 (affected), 7.6.2 (affected), 7.7.10 (affected), 7.2.10.1 (affected), 7.0.8.1 (affected), 7.6.2.1 (affected), 7.2.10.2 (affected), 7.7.10.1 (affected), 7.4.2.4 (affected), 7.4.3 (affected), 7.6.3 (affected), 7.7.11 (affected), 7.6.4 (affected), 10.0.0 (affected), 7.4.4 (affected), 7.4.5 (affected), 7.0.9 (affected), 7.2.11 (affected), 7.7.12 (affected), 7.6.5 (affected), 7.4.6 (affected), 10.0.1 (affected), 7.4.7 (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

0.440%

GitHub Advisory

GHSA-m3pq-vq89-c8m5 ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	Cisco Systems, Inc. · Hosted Service · USA
Reserved	2025-10-08T11:59:15
Published	2026-09-16T20:06:52
Last Updated	2026-09-18T03:55:52

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2026-20324

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2026-20324

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE