CVE-2026-20044
Privilege Escalation in Cisco FMC via Lockdown Bypass
Publication date: 2026-03-04
Last updated on: 2026-03-04
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | secure_firewall_management_center | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the lockdown mechanism of Cisco Secure Firewall Management Center (FMC) Software. It allows an authenticated local attacker with valid administrative credentials to execute arbitrary commands as the root user.
The issue arises because the remediation modules do not have sufficient restrictions when the system is in lockdown mode. An attacker can exploit this by sending specially crafted input to the system command line interface (CLI), bypassing lockdown protections and gaining root-level command execution.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to run arbitrary commands or code with root privileges on the affected device, even when it is supposed to be in lockdown mode.
This could lead to unauthorized control over the system, potentially compromising the security and integrity of the firewall management center and the network it protects.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted administrators have valid administrative credentials, as exploitation requires valid admin access.
Additionally, consider restricting local access to the system CLI and monitor for any unusual command executions.
Applying any available patches or updates from Cisco for the Secure Firewall Management Center Software is recommended once released.