Command Injection Vulnerability in Cisco Secure FTD Software
CVE-2026-20063

6MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Secure Firewall Threat Defense (ftd) Software
Vendor
CVE Published:
4 March 2026

Badges

👾 Exploit Exists

What is CVE-2026-20063?

A command injection vulnerability exists in the Command Line Interface (CLI) of Cisco Secure FTD Software that can be exploited by an authenticated attacker with local access. This flaw is a result of insufficient input validation for user-supplied command arguments. By providing specially crafted input for specific CLI commands, the attacker may gain the ability to execute arbitrary commands on the underlying operating system with root privileges. This presents a significant security risk, highlighting the need for strict access controls and regular security updates to mitigate potential threats.

Affected Version(s)

Cisco Secure Firewall Threat Defense (FTD) Software 7.6.0

Cisco Secure Firewall Threat Defense (FTD) Software 7.7.0

Cisco Secure Firewall Threat Defense (FTD) Software 7.6.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.