Cisco Secure FMC CVE-2026-20344

Requires a valid, pre-existing FMC account holding one of three specific roles - Security Approver, Access Admin, or Network Admin - plus network reachability to the web-based management interface (HTTPS). No user interaction from a victim is needed (UI:N). Exploitation is limited by the authentication/authorization gate: an unprivileged or unauthenticated attacker cannot trigger it directly, and the FMC management interface is typically confined to a management network, further narrowing exposure. The primary risk is insider misuse or use of compromised/phished privileged operator credentials against default FMC configurations.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity SQL injection whose only meaningful barrier is authentication (PR:L). The description tightens PR:L into a concrete prerequisite: the attacker must already hold a valid FMC account with the Security Approver, Access Admin, or Network Admin role - non-trivial but plausible for insiders, compromised operator credentials, or an attacker who has phished a firewall administrator. The real amplifier is the impact chain: the SQLi does not merely read data but also yields an authenticated Administrator's session credentials, converting a mid-privilege account into full administrative control of the firewall-management plane (justifying C:H/I:H/A:H rather than a read-only C:H). There is no EPSS score, no CISA KEV listing, and no public POC, so this is currently a latent rather than actively-exploited threat - no signals conflict here, they simply all point to 'not yet exploited.' SSVC-style reading: exploitation=none, technical impact=total, automatable=no (requires prior valid privileged credentials). Net: a genuine high-priority patch item for FMC operators because of total impact and the platform's role governing enterprise firewalls, but the authenticated-privileged-role gate keeps it below the tier of unauthenticated criticals.

An attacker who has obtained (or been granted) a valid FMC account with Security Approver, Access Admin, or Network Admin role sends a crafted HTTP request to the web-based management interface, injecting SQL through insufficiently validated input. The query returns arbitrary database contents including an active Administrator's session credentials, which the attacker replays to hijack the admin session and reconfigure firewall policy across managed FTD devices. No public exploit code is identified at time of analysis.