Executive brief
Cisco Secure Firewall Management Center (FMC) is a centralized administrative hub used to manage and configure network security policies across an organization's firewalls. A critical security flaw has been identified that allows an unauthorized person to take complete control of this management system over the internet. If exploited, an attacker could gain full administrative access (root), potentially allowing them to disable security protections, intercept data, or launch further attacks within the corporate network. This vulnerability is currently being exploited in the wild by ransomware groups.
Technical details
A deserialization of untrusted data vulnerability (CWE-502) exists in the web-based management interface of Cisco FMC and SCC. The flaw stems from the insecure processing of user-supplied Java byte streams. An unauthenticated remote attacker can exploit this by sending a specially crafted serialized Java object to the management interface. Successful exploitation results in arbitrary Java code execution with root privileges on the underlying operating system. This vulnerability has been observed in active exploitation by threat actors, including those associated with ransomware campaigns. Organizations are advised to restrict management interface access to trusted internal networks and apply vendor-provided patches immediately.
Affected products
- Cisco Secure Firewall Management Center (FMC) 7.2.4.1, 7.2.5, 7.2.5.1, 7.2.5.2
- Cisco Security Cloud Control (SCC) Firewall Management
Timeline
- 2026-03-19: disclosed
- 2026-03-19: advisory
- 2026-03-19: kev added: Added to CISA Known Exploited Vulnerabilities catalog.
- 2026-03-19: exploited