SQL Injection Vulnerability in Cisco Secure FMC Software Management Interface
CVE-2026-20002

8.1HIGH

Key Information:

Vendor

Cisco
Status
Cisco Secure Firewall Management Center (fmc)
Vendor
CVE Published:
4 March 2026

Badges

👾 Exploit Exists

What is CVE-2026-20002?

A vulnerability exists in the web-based management interface of Cisco Secure FMC Software, allowing an authenticated remote attacker to execute SQL injection attacks. This issue stems from insufficient validation of user-supplied input, enabling attackers to send specifically crafted requests to the affected device. If successfully exploited, the attacker could gain unauthorized access to the database and potentially read sensitive files on the operating system. Access to the system requires valid user credentials, making it imperative for users to enhance security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

Cisco Secure Firewall Management Center (FMC) 6.4.0

Cisco Secure Firewall Management Center (FMC) 6.4.0.1

Cisco Secure Firewall Management Center (FMC) 6.4.0.3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.