Platform
cisco
Component
cisco-secure-firewall-management-center-fmc
Fixed in
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
6.4.1
7.0.1
7.0.1
7.0.2
7.1.1
6.4.1
7.0.2
6.4.1
7.1.1
7.0.3
6.4.1
7.2.1
7.0.3
7.0.4
7.1.1
7.2.1
7.0.5
7.2.2
7.0.6
6.4.1
7.3.1
7.2.3
7.3.2
7.2.4
7.1.1
7.2.4
7.2.5
7.0.7
7.2.5
7.2.6
7.3.2
7.4.1
6.4.1
7.0.7
7.2.6
7.4.2
7.2.7
7.4.2
7.0.7
6.4.1
7.2.8
7.2.6
7.3.2
7.2.9
7.6.1
7.4.3
7.2.9
7.0.7
7.4.3
7.2.10
7.0.8
7.7.1
7.4.3
7.2.11
7.6.2
7.4.3
7.0.9
7.6.3
7.7.11
7.2.11
7.0.9
7.6.3
7.2.11
7.7.11
7.4.3
7.4.4
CVE-2026-20044 describes a Command Injection vulnerability within the Cisco Secure Firewall Management Center (FMC) Software. This flaw allows an authenticated, local attacker to execute arbitrary commands with root privileges, potentially leading to complete system takeover. The vulnerability impacts FMC versions 6.4.0 through 7.7.10.1, and Cisco has released updates to address the issue.
Successful exploitation of CVE-2026-20044 grants an attacker root access to the affected Cisco Secure Firewall Management Center. This level of access allows for complete control over the system, including the ability to install malware, modify configurations, steal sensitive data, and potentially pivot to other systems on the network. The ability to execute commands as root significantly expands the attack surface and increases the potential for widespread damage. Given the FMC's role in managing and configuring firewalls, a compromised FMC could lead to a complete breach of network security, allowing attackers to bypass firewall rules and gain access to internal resources.
CVE-2026-20044 was publicly disclosed on March 4, 2026. The vulnerability's impact stems from the ability to execute commands as root, similar to other privilege escalation vulnerabilities. Currently, there are no publicly available exploits, and it is not listed on the CISA KEV catalog. The EPSS score is pending evaluation, but the potential for root access suggests a medium to high probability of exploitation if a suitable exploit is developed and released.
Exploit Status
EPSS
0.01% (3% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-20044 is to upgrade the Cisco Secure Firewall Management Center (FMC) to a patched version. Cisco has released updates to address this vulnerability; refer to the official Cisco advisory for specific version details. If immediate patching is not possible due to compatibility concerns or testing requirements, consider implementing stricter access controls and limiting the number of users with administrative privileges. While not a direct fix, restricting access can reduce the attack surface. Monitor system logs for suspicious activity, particularly commands executed by users with elevated privileges. After upgrading, verify the fix by attempting to execute arbitrary commands through the system CLI while in lockdown mode; the commands should be rejected.
Update the Cisco Secure Firewall Management Center (FMC) to a version that is not affected by this vulnerability. See the Cisco advisory for more details on the patched versions and upgrade instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-20044 is a Command Injection vulnerability affecting Cisco Secure Firewall Management Center (FMC) versions 6.4.0–7.7.10.1, allowing authenticated attackers to execute commands as root.
If you are running Cisco Secure Firewall Management Center versions 6.4.0 through 7.7.10.1, you are potentially affected by this vulnerability. Check your version and upgrade accordingly.
The recommended fix is to upgrade to a patched version of Cisco Secure Firewall Management Center. Refer to the official Cisco advisory for specific version details.
As of now, there are no publicly known active exploits for CVE-2026-20044, but the potential for root access warrants immediate attention and mitigation.
Please refer to the official Cisco Security Advisory for CVE-2026-20044 on the Cisco website (search for 'CVE-2026-20044 Cisco').
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.