Cisco Secure Firewall Management Center RCE Vulnerability Disclosed

• •Critical RCE vulnerability in Cisco FMC Software affecting external database access.
• •Attackers can execute arbitrary commands as root if they control a host in the access list.
• •Cisco has issued patches; no workarounds are available.

A critical vulnerability has been identified in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software, allowing unauthenticated remote attackers to execute arbitrary commands as root. This vulnerability arises from insecure deserialization of a user-supplied Java byte stream from hosts in the external database access list. Attackers can exploit this by sending a crafted Java byte stream to a specific TCP port of the affected device. Successful exploitation could lead to full system compromise. Cisco has released software updates to address this issue, but no workarounds are available. The attack surface is reduced if the FMC management interface is not publicly accessible. This advisory is part of a broader set of advisories released on September 16, 2026.