Cisco Secure FMC Java Deserialization RCE: CVE-2026-20242 Analysis

Cisco Security Advisory: Remote Code Execution Vulnerability in Secure Firewall Management Center (FMC) Software Due to Java Deserialization Vulnerability Overview Vulnerability Type: Remote Code Execution (RCE) resulting from Java deserialization Severity Level: Critical Vulnerability ID: cisco-sa-fmc-javacore-y2NpXxk CVE IDs: CVE-2026-20242, CVE-502 CVSS Score: Base 9.8 Root Cause: Unsafe deserialization of Java byte streams from user input in the FMC External Database Access feature. An attacker can send a specially crafted serialized Java byte stream to a specific TCP port on the affected device to execute arbitrary commands with root privileges and escalate permissions. Exploitation Prerequisites: The attacker must control a host within the external database access list. If the FMC management interface is not exposed to the public internet, the attack surface is reduced. Affected Scope Affected Products: Cisco Secure FMC Software (when External Database Access is enabled and at least one controlled host exists in the access list) Confirmed Unaffected Products: - Secure Firewall Adaptive Security Appliance (ASA) Software - Secure Firewall Threat Defense (FTD) Software Remediation Temporary Mitigation (Workaround): Administrators can disable External Database Access as a temporary mitigation measure until the fixed version is deployed. Fixed Versions: Cisco has released software updates to fix this vulnerability, with no known side effects. Fixed Version Lookup Tool: The page provides the "Cisco Software Checker" tool, which allows users to query fixed versions by platform (e.g., Cisco ASA Software) and release version number (e.g., 9.2.0.3.4). Additional Information Advisory Link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-javacore-y2NpXxk Revision History: Version 1.0, Status: Final, Date: 2026-SEP-18 Acknowledgments: Credit to Andy Niu of TrendAI Research for reporting this vulnerability. > Note: This page does not include POC code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Secure FMC Java Deserialization RCE: CVE-2026-20242 Analysis

More from this source