OTPulse

Cisco Secure Firewall Management Center Software Vulnerabilities

Plan PatchCVSS 9.1cisco-sa-fmc-mulivulns-4PsnFwvxSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) software allow an attacker with admin credentials to gain root access, download sensitive files (including credentials and encryption keys), perform SQL injection attacks on the FMC database, or cause denial of service. The vulnerabilities affect all FMC appliance versions. Cisco has released software updates that address these issues.

What this means
What could happen
An attacker with high-level admin access to the FMC could execute arbitrary commands with root privileges, read sensitive configuration and credential files, disrupt management operations, or manipulate firewall policy through SQL injection. This directly impacts your ability to manage and monitor all connected firewalls across your network.
Who's at risk
Cisco Secure Firewall Management Center (FMC) administrators and operators responsible for managing distributed firewalls across water utilities, municipal electric grids, and other critical infrastructure. Any organization using FMC to centralize firewall policy and monitoring is affected.
How it could be exploited
An attacker with high-privilege admin credentials on the FMC management interface could exploit one or more of these vulnerabilities to gain root-level command execution, exfiltrate sensitive files containing passwords and encryption keys, inject malicious SQL commands into the database, or crash the FMC service causing loss of firewall management capability.
Prerequisites
  • Valid high-privilege (admin) credentials for Cisco Secure Firewall Management Center
  • Network access to the FMC management interface
remotely exploitablehigh CVSS (9.1)multiple vulnerability types (RCE, file disclosure, SQL injection, DoS)requires admin credentials but affects management plane of critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (1)
ProductAffected VersionsFix Status
Secure Firewall Management Center (FMC) AppliancesAll versionsFix available
Remediation & Mitigation
0/5
Do now
0/3
HARDENINGIdentify your current FMC software version and check Cisco's official update advisory for the specific patched version applicable to your deployment
WORKAROUNDRestrict network access to the FMC management interface to only authorized admin workstations; block all other sources at your network perimeter
HARDENINGEnforce multi-factor authentication (MFA) on all FMC admin accounts to reduce the risk of credential compromise
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXSchedule a maintenance window and update Cisco Secure Firewall Management Center software to the latest patched version released by Cisco
Long-term hardening
0/1
HARDENINGReview FMC admin account permissions and remove unnecessary high-privilege accounts
View full vendor advisory
API: /api/v1/advisories/e576715f-222a-497d-aff8-c42d271cd428

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Secure Firewall Management Center Software Vulnerabilities | CVSS 9.1 - OTPulse