Is CVE-2026-20002 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20002 being exploited in the wild.

How severe is CVE-2026-20002?

High severity, with a CVSS score of 8.1, published 4 March 2026.

Is there a fix for CVE-2026-20002?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20002 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20002?

Check whether you run Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20002: Cisco Secure FMC SQL injection in web-based management interface

CVE-2026-20002 · Severity: high · CVSS 8.1 · Published 2026-03-04

Cisco Secure Firewall Management Center (FMC) is a centralized management platform for enterprise firewalls. A SQL injection vulnerability in its web-based management interface allows authenticated users to bypass database security controls, potentially exposing sensitive firewall configurations, access policies, and operational data. An attacker with valid credentials could read or modify the entire database and access files on the underlying system.

Technologies: Cisco Secure Firewall Management Center. Vendors: Cisco.

Quick answers

Is CVE-2026-20002 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20002 being exploited in the wild.
How severe is CVE-2026-20002?: High severity, with a CVSS score of 8.1, published 4 March 2026.
Which products and versions are affected?: Cisco Secure Firewall Management Center <UNKNOWN>.
Is there a fix for CVE-2026-20002?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20002 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20002?: Check whether you run Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a SQL injection vulnerability (CWE-89) in the web-based management interface of Cisco Secure FMC Software, caused by inadequate validation of user-supplied input. The vulnerability requires valid user authentication to exploit; an attacker must send crafted requests to trigger the injection. A successful exploit grants full database access and allows reading certain files on the underlying operating system, potentially including sensitive configuration data and credentials. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

Cisco Secure Firewall Management Center <UNKNOWN>

Timeline

2026-03-04: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.