Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Cisco Secure FMC Software Allows Remote SQL Injection Attacks with Valid Credentials
CVE-2026-20001
Summary
An attacker with valid login credentials can use Cisco Secure FMC Software's REST API to inject malicious SQL code and access sensitive data on the system. This could allow them to read confidential information. To protect your system, ensure you have up-to-date software and limit user access to the REST API.
Original title
A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.
This vulnerability is due to in...
Original description
A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.
This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles:
Administrator
Security approver
Access admin
Network admin
This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles:
Administrator
Security approver
Access admin
Network admin
nvd CVSS3.1
6.5
Vulnerability type
CWE-89
SQL Injection
Published: 4 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026