Cisco FMC CVE-2026-20242: Who Is Affected and What to Patch

CVE-2026-20242 Cisco FMC is a critical vulnerability that Cisco rates CVSS 9.8 and says can allow an unauthenticated remote attacker to execute arbitrary commands as root. But the risk is configuration-bound: Cisco says the affected Cisco Secure Firewall Management Center must have External Database Access enabled with at least one host configured in that feature’s access list, and successful exploitation requires the attacker to control one of those listed hosts.

What can CVE-2026-20242 do?

Cisco describes the flaw as unsafe Java deserialization in Cisco Secure Firewall Management Center. A malicious serialized Java byte stream sent from an allowed host can trigger arbitrary command execution with root privileges.

The vulnerability does not require an FMC user account. That is why Cisco’s severity vector treats the attack as requiring no privileges. However, unauthenticated does not mean unrestricted source access: the attack still depends on the External Database Access trust boundary described by Cisco.

What exact configuration makes an FMC deployment affected?

Check two configuration conditions first:

1. External Database Access is enabled.
2. At least one host is configured in the External Database Access access list.

If those conditions are not present, the deployment does not meet the affected configuration described in Cisco’s advisory.

What additional condition is required for exploitation?

Cisco says an attacker must control a host that is already configured in the External Database Access list.

This distinction is operationally important. An FMC administrator should therefore verify not only whether the feature is enabled, but also which hosts are trusted through the access list and whether any of those systems could be compromised or controlled by an attacker.

Does public internet exposure automatically make the FMC exploitable?

No. Public reachability can increase general attack surface, but it does not replace the exploit prerequisite described by Cisco. For CVE-2026-20242, the controlling boundary is the External Database Access configuration and attacker control of a listed host.

TPS therefore does not describe this vulnerability as exploitable by any arbitrary internet host.

Which Cisco products are affected?

The affected product is Cisco Secure Firewall Management Center Software when the required External Database Access configuration is present.

Cisco explicitly says the following products are not affected by CVE-2026-20242:

• Cisco Secure Firewall Adaptive Security Appliance Software
• Cisco Secure Firewall Threat Defense Software

This product boundary applies to CVE-2026-20242 specifically. Cisco’s broader September Secure Firewall hardening release contains fixes for additional vulnerabilities, so administrators should not assume that every vulnerability in that release has the same product scope.

Which FMC releases are affected?

Cisco’s CVE data identifies affected Secure Firewall Management Center releases across the 7.0, 7.2, 7.3, 7.4, 7.6, 7.7 and 10.0 trains. Later affected builds include 7.0.9, 7.2.11, 7.3.1.2, 7.4.7, 7.6.5, 7.7.12 and 10.0.1.

That shortened list should not be used as a substitute for release-specific validation. Administrators should check the exact build against Cisco’s current advisory and Software Checker before making an upgrade decision.

Which releases fix CVE-2026-20220242?

Cisco’s current September Secure Firewall hardening release identifies these first fixed releases for the supported branches:

What should administrators running FMC 7.3 do?

This is a point where TPS does not infer a missing version.

Cisco’s CVE data identifies 7.3 releases as affected, including builds through 7.3.1.2, but Cisco’s current hardening table does not list a separate 7.3 first-fixed branch.

Administrators on 7.3 should therefore use Cisco Software Checker and Cisco’s current supported-upgrade guidance to determine the appropriate fixed target rather than assuming there is a 7.3.x maintenance release that TPS has not verified.

Is there a workaround?

No. Cisco explicitly says there are no workarounds for CVE-2026-20242.

That does not mean administrators have no temporary risk-reduction option. Cisco separately identifies disabling External Database Access as a mitigation while fixed software is being deployed.

Is disabling External Database Access enough?

It is a temporary mitigation, not the permanent remediation.

Cisco says disabling External Database Access was successful in its test environment but instructs customers to evaluate whether the mitigation is appropriate for their environment and operational requirements.

The long-term remediation is to move to fixed software.

Is CVE-2026-20242 being exploited in the wild?

Cisco PSIRT says it was not aware of public announcements or malicious use of this vulnerability at the time of the advisory.

This is a current-state statement, not a guarantee that exploitation will not emerge later. TPS should update this same canonical if Cisco, CISA or other controlling evidence changes the exploitation state.

Is CVE-2026-20242 in CISA KEV?

The current evidence reviewed for this article did not establish that CVE-2026-20242 had been added to the CISA Known Exploited Vulnerabilities catalog.

That status can change after publication and is therefore a maintenance trigger rather than a permanent claim.

Do not confuse this CVE with other exploited Cisco firewall flaws

Cisco’s broader September hardening release also discusses other Secure Firewall vulnerabilities and identifies separate issues with known exploitation.

That exploitation status must not be transferred to CVE-2026-20242. Cisco’s own advisory for this CVE currently says it is not aware of malicious use.

How do you know remediation is complete?

The strongest remediation state is that the affected FMC has been moved to an appropriate fixed release confirmed through Cisco’s current advisory, hardening guidance or Software Checker.

Disabling External Database Access can reduce exposure while patching is prepared, but administrators should record that as temporary mitigation rather than final remediation.

Verification note

ThePulseSignal reviewed Cisco’s CVE-2026-20242 PSIRT advisory, Cisco’s September Secure Firewall hardening-release guidance and current Cisco/CNA affected-version information. TPS separated the affected configuration from the additional attacker-controlled-host prerequisite and did not infer a nonexistent 7.3 fixed release.

Limitations and unresolved facts

Cisco has not established public exploitation of CVE-2026-20242 in the evidence reviewed. The number of exposed FMC deployments is unknown. CISA KEV status, Cisco advisory revisions and supported upgrade targets can change. Administrators should verify their exact build and supported destination with Cisco before changing production infrastructure.

Bottom line

CVE-2026-20242 Cisco FMC is a serious root-RCE vulnerability, but it is not a blanket statement that every FMC is remotely exploitable. The affected configuration requires External Database Access to be enabled and populated, and Cisco says the attacker must control a host already present in that access list.

If your FMC meets that configuration boundary, verify the exact software build, use Cisco’s fixed-release guidance, and patch. Disabling External Database Access can be used as a temporary mitigation, but Cisco provides no workaround and recommends fixed software as the remediation.