Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
Cisco FMC Software: Unauthenticated Code Execution via Web Interface
CVE-2026-20131
Summary
An attacker can potentially execute malicious code on the FMC device without needing a login, which could lead to unauthorized control of the device. This vulnerability affects the web interface of Cisco's FMC Software, which manages firewalls. To protect your network, ensure that the FMC management interface is not exposed to the public internet.
Original title
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as roo...
Original description
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
nvd CVSS3.1
10.0
Vulnerability type
CWE-502
Deserialization of Untrusted Data
Published: 4 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026