CVE-2026-20341 Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability
An authenticated attacker with admin credentials on a managed device can achieve root privileges on Cisco Secure FMC via unsafe deserialization in sftunnel RPCs.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-20341?
CVE-2026-20341 is a critical unsafe deserialization vulnerability in Cisco Secure Firewall Management Center (FMC), published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker could exploit this vulnerability by sending crafted sftunnel remote procedure calls (RPCs). A successful exploit could allow the attacker to gain root privileges on a device that is running Cisco Secure FMC Software and its high-availability peer. To exploit this vulnerability, the attacker must have valid administrative credentials on a managed Cisco FTD device.
Weakness: CWE-502
Which versions are affected by CVE-2026-20341?
How do I fix CVE-2026-20341?
No fix has been published for CVE-2026-20341 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-20341 being exploited?
There is no known exploitation of CVE-2026-20341 in the wild and no public exploit code.
Sources
Also known as GHSA-355g-mjpr-92rq.