Command Injection Vulnerability in Cisco FXOS Software for Secure Firewall ASA and Secure FTD
CVE-2026-20016

6MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Secure Firewall Threat Defense (ftd) Software
Vendor
CVE Published:
4 March 2026

Badges

👾 Exploit Exists

What is CVE-2026-20016?

A command injection vulnerability exists in the Cisco FXOS Software CLI feature, affecting the Secure Firewall ASA and Secure FTD products. This flaw allows an authenticated local attacker to execute arbitrary commands on the underlying operating system with root privileges. The weakness arises from insufficient input validation of user-supplied command arguments, enabling an attacker with valid administrative credentials to exploit this issue by sending specially crafted input through specific CLI commands. Successful exploitation grants the attacker significant control over the device, compromising the system's integrity.

Affected Version(s)

Cisco Secure Firewall Threat Defense (FTD) Software 7.0.0

Cisco Secure Firewall Threat Defense (FTD) Software 7.0.0.1

Cisco Secure Firewall Threat Defense (FTD) Software 7.0.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.