Advisories
Cisco FMC Faces Critical Vulnerabilities: Root Access, SQLi, and DoS Risks
Cisco’s Secure Firewall Management Center (FMC) is now exposed to a suite of critical flaws that could let attackers gain full root control, steal confidential data, inject malicious SQL, or crash the system. No workarounds exist, but Cisco has issued patches. Immediate update is mandatory for all FMC deployments.
Cisco’s Secure Firewall Management Center (FMC) has been found to contain several critical security holes that can be exploited remotely. The weaknesses allow attackers to:
- Elevate privileges to full root access
- Read and download sensitive files
- Execute arbitrary SQL injection attacks
- Trigger a denial‑of‑service (DoS) condition
Impact
These vulnerabilities carry a Critical severity rating. An attacker who successfully exploits any one of them could compromise the entire FMC infrastructure, potentially exposing network traffic data and configuration secrets.
Mitigation
Cisco has released software updates that address all affected components. No interim workarounds are available. Administrators should immediately download and install the latest patches from the Cisco Security Advisory portal. Failure to update will leave systems vulnerable to compromise.
CVEs
- CVE-2026-20340
- CVE-2026-20341
- CVE-2026-20342
- CVE-2026-20343
- CVE-2026-20344
Security teams are urged to verify patch deployment and review firewall logs for any suspicious activity. Prompt action is essential to maintain network integrity.
Related vulnerabilities
Cisco FMC Java Deserialization Flaw Lets Remote Attacker Gain Root
Cisco’s Secure Firewall Management Center (FMC) suffers a critical insecure Java deserialization bug that permits unauthenticated remote actors to execute arbitrary code as root. By sending a crafted Java byte stream to a specific TCP port from a host listed in the external database access list, an attacker can elevate privileges and run any command. No workaround exists; Cisco has released patches for the affected releases. The flaw is catalogued as CVE‑2026‑20242 and rated Critical.
Read briefing
Cisco IOS XE Hardening Release Addresses 7 Critical CVEs – August 2026
Cisco’s IOS XE team rolled out a hardening update in August 2026 that patches seven critical vulnerabilities discovered during internal testing. No workarounds exist; customers should apply the latest firmware to mitigate the risks. The CVEs span multiple CWE categories and carry a Critical impact rating.
Read briefing
MongoDB Faces Multi‑Vector Exploits: DoS, Data Breach & Integrity Hits Across Drivers & Server
CERT‑FR has issued a critical alert on September 14, 2026 after discovering a suite of vulnerabilities in MongoDB that span the core server and a wide range of drivers (C, C#, C++, Go, Java, PHP, Python, Ruby, Rust). The flaws allow attackers to trigger remote denial‑of‑service, leak sensitive data, and tamper with database contents. All versions prior to the listed releases are affected. Immediate patching and configuration hardening are mandatory.
Read briefing
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing