Cisco FMC CVE-2026-20324

Exploitation requires the attacker to either possess valid user credentials on the affected Cisco Secure FMC or to control/hijack a registered sftunnel peer connection, then issue an sftunnel inter-device protocol command that writes an arbitrary file to disk; the planted file is subsequently executed with root privileges. Limiting factors: this is NOT unauthenticated (PR:L - valid credentials or an established/hijacked sftunnel peer relationship is mandatory), it targets the sftunnel inter-device communication path (typically used between FMC and managed FTD/firewall devices rather than exposed to arbitrary internet clients), and no user interaction is needed. There is no indication a non-default configuration is required - the flawed file-write permission is inherent to the sftunnel peer role.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the description: a registered sftunnel peer (or an attacker who hijacks the sftunnel connection) can write an arbitrary file that executes with root privileges, yielding full device compromise (C:H/I:H/A:H) and a scope change (S:C) because a peer/user-level foothold escalates to root control of the FMC and, by extension, the firewalls it manages. Unlike Cisco's vague grouped 'hardening' advisories (e.g. cisco-sa-hardening-asaftdfmc-*), this is a DEDICATED single-vulnerability advisory with a concrete named root cause (incorrect file-write permissions on an sftunnel peer, CWE-862 missing authorization), which raises confidence in the technical claim. Key exploitation signals are MISSING/negative: no EPSS score provided, no CISA KEV listing, and no public POC - so there is currently no evidence of active or automated exploitation. The one meaningful mitigating factor is the PR:L requirement: the attacker must hold valid user credentials on the device or control a registered sftunnel peer, which limits opportunistic mass exploitation and points toward an insider/post-compromise or lateral-movement scenario rather than internet-wide scanning. Note the input Tag 'Authentication Bypass' conflicts with both the CWE (CWE-862, authorization) and the description (exploitation REQUIRES valid authentication) - treat that tag as mislabeled.

An attacker with valid low-privilege credentials on a Cisco Secure FMC - or who has hijacked/impersonated a registered sftunnel peer - sends a crafted sftunnel command that writes a malicious file to an arbitrary path on the device. Because sftunnel-written files are executed with root privileges, the planted file runs as root, giving the attacker full command execution and control over the FMC and the firewalls it manages. No public exploit code has been identified at time of analysis.