CVE-2026-20344

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software (affected versions not specified)

Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of user-supplied input. To exploit this, an attacker requires a valid account with the role of Security Approver, Access Admin, or Network Admin. By sending a crafted HTTP request to the management interface, an attacker can retrieve any data from the database, obtain session credentials of an authenticated Administrator, and execute actions with administrative privileges. Approximately 828 instances have been identified globally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.