# CVE-2026-20323: Cisco Secure FMC and FTD sftunnel authentication bypass

Source: https://junglewise.ai/threats/cve-2026-20323-cisco-secure-fmc-and-ftd-sftunnel-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20323 · Severity: high · CVSS 8.3 · Published 2026-09-16

Cisco Secure Firewall Management Center and Threat Defense Software use an inter-device communication protocol (sftunnel) to manage connections between firewall appliances. An unauthenticated attacker on the same network can bypass authentication by presenting a forged certificate, gaining root-level access to the firewall. Successful exploitation requires the sftunnel connection to be temporarily down or disrupted, allowing an attacker to assume the identity of a trusted peer device.

Technologies: [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Secure Firewall Management Center](https://junglewise.ai/threats/technologies/secure-firewall-management-center). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20323 being exploited in the wild.

**How severe is CVE-2026-20323?** High severity, with a CVSS score of 8.3, published 16 September 2026.

**Which products and versions are affected?** Cisco Secure Firewall Threat Defense Multiple releases (see vendor advisory for specific versions); Cisco Secure Firewall Management Center Multiple releases (see vendor advisory for specific versions).

**Is there a fix for CVE-2026-20323?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20323 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-20323?** Check whether you run Cisco Secure Firewall Threat Defense or Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CVE-2026-20323) stems from improper TLS certificate validation in the sftunnel inter-device communication protocol. An unauthenticated, adjacent attacker can exploit this by connecting to the sftunnel port with a crafted TLS certificate to impersonate a peer device and register with root-level (manager role) privileges. The attack vector is adjacent network access; exploitation succeeds only when the existing sftunnel connection is down or can be disrupted. A successful exploit grants full administrative access equivalent to root on both Cisco Secure FMC and Secure FTD appliances. Cisco has released software updates to address this vulnerability; no workarounds are available.

## Affected products

- Cisco Secure Firewall Management Center Multiple releases (see vendor advisory for specific versions)
- Cisco Secure Firewall Threat Defense Multiple releases (see vendor advisory for specific versions)

## Timeline

- 2026-09-16: disclosed: CVE-2026-20323 published

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)