ZDI 2026-09-16

ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability

CVE-2026-20242

Machine-generated analysis · WAYSCloud LLM

Unauthenticated remote code execution via CommandSinkRmi deserialization in Cisco Secure Firewall Management Center.

Context

The advisory concerns Cisco Secure Firewall Management Center. It reports a deserialization of untrusted data in the CommandSinkRmi component that enables remote code execution without authentication. The CVSS base score is 8.1 (CVE-2026-20242).

Operator considerations

Check: verify whether Cisco has released an update or advisory for CVE-2026-20242.
Isolate: limit network access to the Management Center to trusted hosts only.
Log: enable logging for CommandSinkRmi activity and monitor for unexpected connections.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-20242.

Read the full advisory on ZDI →