# CVE-2026-20002: Cisco Secure FMC SQL injection in web-based management interface

Source: https://junglewise.ai/threats/cve-2026-20002-cisco-secure-fmc-sql-injection-in-web-based-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20002 · Severity: high · CVSS 8.1 · Published 2026-03-04

Cisco Secure Firewall Management Center (FMC) is a centralized management platform for enterprise firewalls. A SQL injection vulnerability in its web-based management interface allows authenticated users to bypass database security controls, potentially exposing sensitive firewall configurations, access policies, and operational data. An attacker with valid credentials could read or modify the entire database and access files on the underlying system.

Technologies: [Cisco Secure Firewall Management Center](https://junglewise.ai/threats/technologies/secure-firewall-management-center). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20002 being exploited in the wild.

**How severe is CVE-2026-20002?** High severity, with a CVSS score of 8.1, published 4 March 2026.

**Which products and versions are affected?** Cisco Secure Firewall Management Center <UNKNOWN>.

**Is there a fix for CVE-2026-20002?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20002 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20002?** Check whether you run Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SQL injection vulnerability (CWE-89) in the web-based management interface of Cisco Secure FMC Software, caused by inadequate validation of user-supplied input. The vulnerability requires valid user authentication to exploit; an attacker must send crafted requests to trigger the injection. A successful exploit grants full database access and allows reading certain files on the underlying operating system, potentially including sensitive configuration data and credentials. Cisco has released software updates to address this vulnerability; no workarounds are available.

## Affected products

- Cisco Secure Firewall Management Center <UNKNOWN>

## Timeline

- 2026-03-04: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd)

## Related threats

- [Cisco Secure FMC SSO token forgery in ASDM handler](https://junglewise.ai/threats/cve-2026-76413-cisco-secure-fmc-sso-token-forgery-in-asdm-handler)
- [Cisco Secure FMC privilege escalation in remote diagnostics debugger](https://junglewise.ai/threats/cve-2026-76412-cisco-secure-fmc-privilege-escalation-in-remote-diagnostics)
- [Cisco Secure Firewall software resource lifecycle vulnerability](https://junglewise.ai/threats/cve-2026-20336-cisco-secure-firewall-software-resource-lifecycle-vulnerability)
- [Cisco Secure FMC and FTD sftunnel authentication bypass](https://junglewise.ai/threats/cve-2026-20323-cisco-secure-fmc-and-ftd-sftunnel-authentication-bypass)
- [Cisco Secure FMC and FTD memory exhaustion in sftunnel](https://junglewise.ai/threats/cve-2026-20295-cisco-secure-fmc-and-ftd-memory-exhaustion-in-sftunnel)