Quick answers
- Is CVE-2026-20324 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20324 being exploited in the wild.
- How severe is CVE-2026-20324?
- Critical severity, with a CVSS score of 9.9, published 16 September 2026.
- Which products and versions are affected?
- Cisco Secure Firewall Management Center See Cisco advisory for affected releases.
- Is there a fix for CVE-2026-20324?
- A patch was published on 2026-09-16: Cisco released software updates on the same date as disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20324 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-20324?
- Check whether you run Cisco Secure Firewall Management Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A CWE-862 (Improper Authorization) vulnerability exists in the sftunnel protocol where registered sftunnel peers have incorrect file write permissions, allowing them to write arbitrary files to any location on the device. An attacker can exploit this by either hijacking an sftunnel communication connection or leveraging valid sftunnel peer status to send a malicious sftunnel command that writes a file to disk. The file is subsequently executed with root privileges, achieving arbitrary code execution. The attacker must possess valid user credentials on the affected FMC device to exploit this vulnerability. Cisco has released software patches to address this issue; no workarounds are available.
Affected products
- Cisco Secure Firewall Management Center See Cisco advisory for affected releases
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Cisco released software updates on the same date as disclosure