Cisco Emergency Bundle Fixes 18 Secure Firewall Flaws Including sftunnel Root RCE

Overview

On September 16, 2026, Cisco released software updates for 18 vulnerabilities across its Secure Firewall product line. Eight of the flaws are rated critical and ten are rated high severity. The affected platforms span Firewall Management Center (FMC), Secure Adaptive Security Appliance (ASA) software, and Secure Firewall Threat Defense (FTD) software. Cisco shipped the fixes across five separate advisories. The company states that it is not aware of any public announcements or malicious use of these flaws, and no proof-of-concept exploit has been confirmed.

Mechanism and Exploitation Conditions

The most severe issue, CVE-2026-20324, is a flaw in the sftunnel component of Firewall Management Center that carries a CVSSv3 base score of 9.9. It permits root-level arbitrary code execution when an attacker delivers a crafted payload to the management tunnel component. In parallel, CVE-2026-20242 is a Java deserialization weakness in FMC software scored 9.8: an unauthenticated attacker who can reach the affected interface can send a crafted Java byte stream and execute arbitrary commands as root.
A joint hardening release addresses additional critical defects in ASA, FTD, and FMC software. CVE-2026-20329, CVE-2026-20330, and CVE-2026-20332 each rate 9.9 and cover exceptional-conditions handling, improper neutralization, and improper access control respectively. CVE-2026-20331, rated 9.6, describes a protection-mechanism failure in the same combined release. CVE-2026-20341 (9.1) allows root command execution through sftunnel deserialization, and CVE-2026-76420 (9.0) covers an impersonated sftunnel connection.
Exploitation conditions differ by component. The deserialization and sftunnel weaknesses require network reachability to management or tunnel endpoints; several of the remaining flaws require an authenticated attacker with limited privileges. None of the 18 flaws has been confirmed as actively exploited.

Impact

A successful attack against the management plane leads to full device takeover with root privileges. Because firewalls guard the edge of enterprise networks, a root compromise breaks the first line of defense: an attacker can alter policies, capture traffic, and pivot into protected internal segments. The advisories also cover SQL injection, privilege escalation, and information disclosure issues, including CVE-2026-20344, an 8.8-rated SQL injection flaw, and several bugs that allow authenticated attackers to raise privileges or read sensitive data.

Affected Products and Versions

The flaws affect specific releases of Firewall Management Center, ASA software, and Threat Defense software. Cisco publishes the exact fixed builds inside each of the five advisories, so administrators must match their deployed branches against the advisory tables rather than relying on a single global version boundary.

Remediation and Mitigation

Cisco released free software updates for all 18 defects and recommends applying them without delay. There are no workarounds for most of these flaws. Administrators should prioritize the unauthenticated root RCE bugs in the Java deserialization advisory and the sftunnel root RCE advisory, then review the joint ASA, FTD, and FMC hardening release, followed by the two multi-flaw FMC bulletins tracked as cisco-sa-fmc2-multivulns and cisco-sa-fmc-mulivulns. Restricting management access to trusted hosts reduces exposure while patching completes.

Sources

• SecurityOnline: Cisco Patches 18 Secure Firewall Flaws, Several Root RCE (September 17, 2026)
• Cisco Secure Firewall advisories referenced by the report (five bulletins, September 16, 2026)