CVE-2026-20324: Cisco Secure Firewall Management Center RCE

CVE-2026-20324 Overview

CVE-2026-20324 is a critical vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software. An authenticated remote attacker can exploit missing authorization checks [CWE-862] to write arbitrary files anywhere on the device. The written file executes with root privileges, resulting in full system compromise.

Cisco disclosed the vulnerability in its security advisory cisco-sa-fmc-sftunn-codex-c3O4Jft2. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, reflecting impact beyond the vulnerable component.

Critical Impact
An attacker with valid sftunnel peer credentials, or one who hijacks an sftunnel connection, can write malicious files that execute as root on the FMC appliance.

Affected Products

Cisco Secure Firewall Management Center (FMC) Software
Devices participating in sftunnel inter-device communication
Registered sftunnel peers connected to affected FMC deployments

Discovery Timeline

2026-09-16 - CVE-2026-20324 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-20324

Vulnerability Analysis

The sftunnel protocol handles inter-device communication between Cisco Secure Firewall Management Center and its managed devices. Registered sftunnel peers hold excessive filesystem permissions on the FMC appliance. The protocol does not restrict where a peer can write files.

An authenticated attacker submits an sftunnel command that writes an arbitrary file to a location interpreted or executed by the system. Because the write occurs with elevated privileges, the attacker can drop a payload that later runs as root. This bridges an authenticated peer role into full administrative control of the management plane, which itself governs downstream firewalls.

Root Cause

The root cause is a missing authorization check [CWE-862] in the sftunnel file-handling logic. The protocol trusts that any registered peer is authorized to write to any path. No path allowlist, permission boundary, or user-context validation restricts the write target. This design flaw converts a peer role into an arbitrary file-write primitive.

Attack Vector

Exploitation requires network reachability to the sftunnel service and valid credentials on the affected device. An attacker achieves the prerequisite by either compromising a registered peer or hijacking an existing sftunnel connection. Once connected, the attacker issues a crafted sftunnel command specifying a malicious file and a sensitive destination path. When the file is executed by the system or an administrator, code runs with root privileges.

No verified public exploit code is available. See the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-20324

Indicators of Compromise

Unexpected files appearing in system directories such as /etc/, /usr/local/, cron paths, or startup script locations on the FMC appliance
sftunnel sessions originating from IP addresses not matching registered managed devices
New or modified executables owned by root with recent timestamps that do not correspond to a Cisco patch cycle
Unexplained root-level process execution shortly after sftunnel activity

Detection Strategies

Monitor sftunnel authentication logs for peer registrations, reconnections, or credential reuse from unexpected sources
Enable file integrity monitoring on system, cron, and service directories of FMC appliances
Correlate sftunnel command activity with subsequent filesystem writes and process creation events
Alert on any process spawned as root that was not present in a known-good baseline of the FMC image

Monitoring Recommendations

Forward FMC syslog, audit, and sftunnel logs to a centralized analytics platform for retention and correlation
Baseline expected sftunnel peer inventory and alert on deviations
Restrict and monitor management-plane network segments carrying sftunnel traffic (TCP 8305)
Review administrative access logs for credential compromise indicators preceding sftunnel abuse

How to Mitigate CVE-2026-20324

Immediate Actions Required

Apply the fixed Cisco Secure Firewall Management Center Software release identified in the Cisco Security Advisory
Rotate credentials for all sftunnel-registered devices and administrative accounts on the FMC
Audit the current list of registered sftunnel peers and remove any that are unrecognized or decommissioned
Restrict network access to the sftunnel service so only authorized managed devices can reach TCP 8305

Patch Information

Cisco has published fixed software versions in the advisory cisco-sa-fmc-sftunn-codex-c3O4Jft2. Consult the advisory for the specific fixed releases that apply to your FMC deployment and upgrade path. No workaround fully addresses the underlying authorization flaw; patching is the required remediation.

Workarounds

Enforce strict network segmentation so only trusted managed firewalls can initiate sftunnel connections to the FMC
Terminate sftunnel sessions from peers that are no longer in service and unregister them from FMC
Require certificate and credential rotation on any peer suspected of compromise before reconnecting to FMC

bash

# Configuration example: restrict sftunnel (TCP 8305) to known managed devices
# Apply on upstream firewall or ACL protecting the FMC management interface
access-list FMC_MGMT permit tcp host <MANAGED_DEVICE_IP> host <FMC_IP> eq 8305
access-list FMC_MGMT deny tcp any host <FMC_IP> eq 8305
access-list FMC_MGMT permit ip any any