CVE-2026-20324

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center (FMC) Software (affected versions not specified)

Description A flaw in the sftunnel inter-device communication protocol allows an authenticated remote attacker to execute arbitrary commands with root privileges. The issue stems from incorrect permissions granted to registered sftunnel peers, enabling them to write arbitrary files to any location on the device. An attacker with valid user credentials can exploit this by hijacking an sftunnel communication connection or acting as a registered peer to write a malicious file to the disk. Approximately 1 million instances were identified globally via ZoomEye. No malicious exploitation has been reported.

Recommendations Update to the fixed releases provided by Cisco.