Executive brief
Cisco Secure Firewall Management Center (FMC) is a centralized platform for managing enterprise firewalls and security policies. A vulnerability in the web-management interface allows authenticated users with read-only access (Security Analyst role or higher) to execute arbitrary commands with root privileges on the management server. An attacker with valid low-level credentials can exploit this by sending a crafted HTTP request to save and execute malicious code, potentially compromising the entire firewall infrastructure managed by that FMC instance.
Technical details
This vulnerability is a deserialization flaw (CWE-502) in the web-management component of Cisco Secure FMC Software. The vulnerability exists because the application deserializes untrusted, user-controlled data from HTTP payloads without proper validation. An authenticated attacker with at least Security Analyst role (read-only) can send a crafted HTTP payload to the management interface, save it as a malicious object, and trigger its execution on the underlying OS with root privileges. The attack requires network access to the FMC management interface and valid user credentials but no further user interaction. Cisco has released software updates to address this vulnerability; no workarounds are available.
Affected products
- Cisco Secure FMC <UNKNOWN>
Timeline
- 2026-09-16: disclosed