CVE-2026-20340

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software (affected versions not specified)

Description An authenticated remote attacker can execute arbitrary commands with root privileges due to unsecured deserialization of user-controlled data within the web-management interface. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that the application can use. An attacker with at least Security Analyst (read-only) credentials can exploit this by sending a crafted HTTP payload, allowing them to save and execute the payload on the underlying operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.