This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 57 vulnerabilities
Cisco fixes 57 vulnerabilities in various products. The most severe vulnerabilities are described below; the remaining ones can be found at [1]. Products and their fixed versions: Cisco Catalyst SD-WAN Manager - 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 [2] Snort 3 - 3.6.3.0, 3.9.2.0, 3.9.3.0, 3.9.5.0, 3.9.6.0, 3.9.7.0 [3][4] Cisco IOS XE Software - 17.12.7, 17.15.5, 17.18.3, 26.1.1 [3][4] Cisco Cyber Vision - 5.3.3 [3][4] Secure Endpoint Connector (Linux) - 1.28.1 [5] Secure Endpoint Connector (Mac) - 1.27.2 [5] Secure Endpoint Connector (Windows) - 8.6.0 [5] Secure Endpoint Private Cloud - 4.2.7 [5] The availability of a fix for Cisco Secure Firewall ASA, Secure FMC and Secure FTD Software can be verified using the Cisco Software Checker tool [6].
Allows an unauthenticated remote attacker to bypass authentication and run scripts/commands using forged HTTP requests, due to an improperly created system process at startup in the web interface of Cisco Secure Firewall Management Center (FMC), thereby potentially gaining root access to the underlying operating system [7].
The vulnerability is present in product:
- Cisco Secure Firewall Management Center Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2026-20079 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 4. 3. 2026.
Allows an unauthenticated remote attacker to execute arbitrary code and escalate their privileges to root by sending a forged serialized Java object, due to insecure deserialization of a user-supplied Java byte stream in the web interface of Cisco Secure Firewall Management Center (FMC) [8].
The vulnerability is present in product:
- Cisco Secure Firewall Management Center Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2026-20131 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 4. 3. 2026.
Allows an unauthenticated remote attacker to gain access to the system and execute commands with the netadmin role by sending a forged API request, due to insufficient authentication of API requests in Cisco Catalyst SD-WAN Manager [2].
The vulnerability is present in product:
- Cisco Catalyst SD-WAN;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-20129 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
Allows an authenticated remote attacker to perform SQL injection, gain full access to the database and subsequently read selected files on the underlying operating system, due to insufficient validation of user input in the web interface of Cisco Secure Firewall Management Center (FMC) [9].
The vulnerability is present in product:
- Cisco Secure Firewall Management Center Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X
More information:
- CVE-2026-20002 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 4. 3. 2026.
Allows an unauthenticated remote attacker to carry out a DoS attack by sending forged messages, due to insufficient error checking when processing Remote Access SSL VPN authentication messages in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software [10].
The vulnerability is present in products:
- Cisco Secure Firewall ASA Software;
- Cisco Secure FTD Software;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2026-20101 at cve.org, NVD
- CWE-330: Use of Insufficiently Random Values at cwe.mitre.org
The vulnerability was publicly disclosed 4. 3. 2026.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-css-Fn4QSZ
- [6] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
- [8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
- [9] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd
- [10] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-m9sx6MbC
By CESNET, z.s.p.o. Michaela Jarošová on 5. 3. 2026.