Cisco Patches Firewall Flaws Enabling Unauthenticated Root Access

Cisco fixed 18 vulnerabilities in its Secure Firewall product line on 16 September 2026, covering Firewall Management Center (FMC), Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The flaws comprise eight critical and 10 high-severity issues, with the most serious rated CVSS 9.9. Several can potentially enable remote code execution with root privileges.

The article says no exploitation has been confirmed: Cisco PSIRT is not aware of public announcements or malicious use, and no proof-of-concept has been confirmed.

Among the most severe issues are CVE-2026-20242, a CVSS 9.8 Java deserialisation vulnerability in FMC that Cisco says could let an unauthenticated attacker send a crafted Java byte stream and execute arbitrary commands as root, and CVE-2026-20324, a CVSS 9.9 sftunnel flaw that can also lead to root-level code execution. CVE-2026-20329, CVE-2026-20330 and CVE-2026-20332 are each rated 9.9 and affect combinations of ASA, FTD and FMC. Other reported weaknesses include CVE-2026-20344, an 8.8-rated SQL injection flaw, alongside privilege-escalation and information-disclosure issues.

Cisco has issued fixed software releases, with exact affected and remediated versions listed in its individual advisories. The article recommends upgrading promptly, prioritising the unauthenticated root-code-execution flaws, then applying the joint ASA, FTD and FMC hardening release and two FMC multi-vulnerability bulletins. It says most issues have no workaround and advises restricting management access to trusted hosts.