Cisco patches critical CVSS 9.9 root code execution flaw in Secure Firewall Management Center

Cisco has shipped fixes for a critical vulnerability in Secure Firewall Management Center (FMC) that would let an unauthenticated remote attacker execute arbitrary code with root privileges. Tracked as CVE-2026-20324 and scored 9.9 on the CVSS scale, the flaw sits in the product's sftunnel component and was disclosed as part of a broader wave of Cisco Secure Firewall fixes on September 16, 2026, according to a technical write-up on dev.to.

How the flaw works

sftunnel is the encrypted channel FMC uses to communicate with the Secure Firewall devices it manages. According to the dev.to analysis, the bug lies in how that tunnel processes crafted input: an attacker who can push a specially formed payload to the sftunnel service can reach the vulnerable code path and run commands as root.

Two details drive the severity score. Exploitation needs no valid account on the target, and it needs no interaction from a victim. The practical precondition is network reachability of the management or tunnel endpoint.

Why root on FMC scales beyond one box

FMC is the policy brain of a firewall deployment, distributing rules and configuration to every device it manages. The dev.to write-up spells out the consequences of root-level control: an attacker could rewrite access rules, switch off logging, push hostile configuration downstream, and pivot toward protected network segments. Compromising one FMC instance is therefore not a single-host incident but a potential fleet-wide one.

Affected software and remediation

Cisco's advisory covers specific releases of FMC software, and the same September 2026 update wave also addresses related defects in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. Because the batch spans multiple products, dev.to advises administrators to reconcile their deployed builds against the exact fixed releases listed in the advisory rather than assuming a single version boundary separates vulnerable from safe code.

Cisco has released free software updates for the affected releases. Most of the flaws in this batch have no workaround, which makes patching the primary control. Until updates are in place, the recommended interim measures are to restrict management-plane access to trusted hosts and dedicated management subnets, and to monitor management and tunnel activity for unexpected sessions.

Per the advisory as relayed by dev.to, Cisco said it had no knowledge of public announcements or malicious exploitation of the flaw at the time of disclosure. CERT-In has also issued a vulnerability note, CIVN-2026-0464, which the write-up cites.

What internet scans can and cannot tell you

The dev.to analysis includes a counterintuitive data point: a ZoomEye query filtered on this CVE returned zero indexed instances. That is not evidence that exposed FMC deployments are absent from the internet. It reflects the fact that the vulnerable sftunnel code path cannot be fingerprinted from outside using that query alone. Teams should treat a clean scan result as uninformative here and rely on asset inventories and version checks against the advisory instead.

Why it matters

Management planes are the highest-value target in any firewall estate, and an unauthenticated, root-level code execution bug rated 9.9 in one is close to the worst-case exposure. Because FMC distributes policy to every managed firewall, a single unpatched instance can be leveraged into network-wide compromise, with attackers able to silently reshape access rules and suppress the logging that would reveal them. With no workaround available for most of the affected flaws, applying Cisco's updates, and locking down management access in the meantime, should be treated as urgent by any organization running the FMC, ASA or FTD releases named in the advisory.