---
id: CVE-2026-20044
title: "A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root.\r\n\r\nThis vulnerability is due to insufficient restrict…"
summary: "A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root.\r\n\r\nThis vulnerability is due to insufficient restrict…"
severity: medium
cvss: 6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-269
vendor: cisco
product: secure_firewall_management_center
affected:
  - 'secure_firewall_management_center >= 6.4.0, <= 6.4.0.18'
  - 'secure_firewall_management_center >= 7.0.0, <= 7.0.8.1'
  - 'secure_firewall_management_center >= 7.1.0, <= 7.1.0.3'
  - 'secure_firewall_management_center >= 7.2.0, <= 7.2.10.2'
  - 'secure_firewall_management_center >= 7.3.0, <= 7.3.1.2'
  - 'secure_firewall_management_center >= 7.4.0, <= 7.4.3'
  - 'secure_firewall_management_center >= 7.6.0, <= 7.6.2.1'
  - 'secure_firewall_management_center >= 7.7.0, <= 7.7.10.1'
published: '2026-03-04'
updated: '2026-09-02'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20044'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inject-S9ZM4EJf
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.00138
epssPercentile: 0.03526
ingestedAt: '2026-09-02T15:46:27.587Z'
---

## Overview

A vulnerability in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, local attacker to perform arbitrary commands as root.

This vulnerability is due to insufficient restrictions on remediation modules while in lockdown mode. An attacker could exploit this vulnerability by sending crafted input to the system CLI of the affected device. A successful exploit could allow the attacker to run arbitrary commands or code as root, even when the system is in lockdown mode. To exploit this vulnerability, the attacker must have valid administrative credentials.

## Affected

- `secure_firewall_management_center >= 6.4.0, <= 6.4.0.18`
- `secure_firewall_management_center >= 7.0.0, <= 7.0.8.1`
- `secure_firewall_management_center >= 7.1.0, <= 7.1.0.3`
- `secure_firewall_management_center >= 7.2.0, <= 7.2.10.2`
- `secure_firewall_management_center >= 7.3.0, <= 7.3.1.2`
- `secure_firewall_management_center >= 7.4.0, <= 7.4.3`
- `secure_firewall_management_center >= 7.6.0, <= 7.6.2.1`
- `secure_firewall_management_center >= 7.7.0, <= 7.7.10.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.