OTPulse

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Plan PatchCVSS 9.8cisco-sa-fmc-javarce-y2NypXwkSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. The vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host configured in the external database access list. An attacker could exploit this by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device, resulting in arbitrary command execution with root privileges. This vulnerability can only be exploited by an attacker who has control of a host in the external database access list.

What this means
What could happen
An attacker with control of a host in your FMC's external database access list could gain root-level command execution on your FMC appliance, allowing them to compromise firewall policies, extract sensitive configuration data, or disrupt your security monitoring infrastructure.
Who's at risk
This affects network security teams and IT operations who manage Cisco Secure Firewall Management Center (FMC) appliances. FMC is the central management platform for Cisco firewalls, so compromise could impact all downstream firewalls and your security visibility across the entire network. Any organization using FMC with external database access enabled is potentially vulnerable.
How it could be exploited
An attacker must first gain control of a host that is already in the FMC's external database access list (or convince you to add their host). They then send a crafted Java serialized byte stream to the specific TCP port on the FMC appliance where external database access is configured. The insecure deserialization logic processes this malicious payload and executes arbitrary commands as root.
Prerequisites
  • Host must be in the FMC external database access list
  • Network path (TCP) to the FMC appliance external database port from that host
  • No authentication required
remotely exploitableno authentication requiredlow complexityhigh CVSS (9.8)affects critical security infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (1)
ProductAffected VersionsFix Status
Secure Firewall Management Center (FMC) AppliancesAll versionsFix available
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDRestrict hosts in the external database access list to only trusted, controlled internal systems
HARDENINGImplement network segmentation and firewall rules to limit external database access port exposure from untrusted network zones
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco Secure Firewall Management Center to the patched version released by Cisco
View full vendor advisory
API: /api/v1/advisories/33ca5e4a-01cf-42f4-aa9c-e89c15ad5479

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.