CVE-2026-20323: Cisco Secure FMC and FTD sftunnel authentication bypass

CVE-2026-20323 · Severity: high · CVSS 8.3 · Published 2026-09-16

Cisco Secure Firewall Management Center and Threat Defense Software use an inter-device communication protocol (sftunnel) to manage connections between firewall appliances. An unauthenticated attacker on the same network can bypass authentication by presenting a forged certificate, gaining root-level access to the firewall. Successful exploitation requires the sftunnel connection to be temporarily down or disrupted, allowing an attacker to assume the identity of a trusted peer device.

Technologies: Cisco Secure Firewall Threat Defense, Cisco Secure Firewall Management Center. Vendors: Cisco.

Quick answers

Is CVE-2026-20323 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20323 being exploited in the wild.
How severe is CVE-2026-20323?
High severity, with a CVSS score of 8.3, published 16 September 2026.
Which products and versions are affected?
Cisco Secure Firewall Threat Defense Multiple releases (see vendor advisory for specific versions); Cisco Secure Firewall Management Center Multiple releases (see vendor advisory for specific versions).
Is there a fix for CVE-2026-20323?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20323 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-20323?
Check whether you run Cisco Secure Firewall Threat Defense or Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CVE-2026-20323) stems from improper TLS certificate validation in the sftunnel inter-device communication protocol. An unauthenticated, adjacent attacker can exploit this by connecting to the sftunnel port with a crafted TLS certificate to impersonate a peer device and register with root-level (manager role) privileges. The attack vector is adjacent network access; exploitation succeeds only when the existing sftunnel connection is down or can be disrupted. A successful exploit grants full administrative access equivalent to root on both Cisco Secure FMC and Secure FTD appliances. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

  • Cisco Secure Firewall Management Center Multiple releases (see vendor advisory for specific versions)
  • Cisco Secure Firewall Threat Defense Multiple releases (see vendor advisory for specific versions)

Timeline

  • 2026-09-16: disclosed: CVE-2026-20323 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.