Cisco Secure FMC CVE-2026-20341

Exploitation requires the attacker to already hold valid administrative credentials on a Cisco FTD device that is managed by the target FMC. From that position the attacker abuses the pre-existing sftunnel inter-device management connection (the FMC-to-FTD control channel) to send crafted sftunnel RPCs that are insecurely deserialized by the FMC. Limiting factors: this is NOT unauthenticated - it demands FTD administrative access (PR:H), so the attacker must be an insider or have already compromised a managed firewall; there is no user-interaction requirement (UI:N). The scope change means a single compromised managed FTD yields root on the central FMC and its HA peer, so the blast radius is disproportionate to the initial foothold. Deployments where FTD admin credentials are tightly controlled and segmented from untrusted parties materially reduce realistic exploitability.

This is a genuine high-priority issue, though not a drop-everything internet-facing emergency. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1) is internally consistent with the description: network-reachable, low complexity, but requiring high privileges (valid administrative credentials on a managed FTD device) and yielding root with a scope change onto the FMC and its HA peer. The scope change (S:C) is the key driver of the 9.1 - the attacker's authorization boundary is a managed FTD, but successful exploitation compromises the managing FMC (a different, more trusted security-control plane) and its high-availability partner, meaning one compromised managed device can escalate to full control of the security-management infrastructure. Signal comparison: no EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation is presently theoretical - 'no public exploit identified at time of analysis.' The advisory is a Cisco self-report (cisco-sa-fmc-mulivulns-4PsnFwvx), which typically means vendor-discovered/coordinated disclosure rather than observed in-the-wild activity. The PR:H requirement is the primary real-world limiter: an attacker must already hold admin on a managed firewall, which substantially narrows the population of viable attackers to insiders or those who have already breached an FTD. Net: treat as high priority for patching because the impact (root on the central firewall manager + HA peer) is severe and the deserialization primitive (CWE-502) is reliable, but the PR:H prerequisite means it is not mass-exploitable against exposed defaults.

An attacker who has obtained valid administrative credentials on a managed Cisco FTD device (for example a rogue admin, or an attacker who previously compromised a branch firewall) sends crafted sftunnel remote procedure calls over the established sftunnel management connection to the FMC. The unsecured deserialization of that untrusted RPC data executes attacker-controlled code, granting root on the FMC and propagating to its high-availability peer. No public exploit code has been identified at time of analysis.