Answer in brief
CVE-2026-20323 records a High severity (CVSS 8.3) vulnerability in Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass Vulnerability. The current sources do not mark it as known exploited. The current feed maps Cisco/Cisco Secure Firewall Management Center (FMC) (generic), Cisco/Cisco Secure Firewall Threat Defense (FTD) Software (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Cisco/Cisco Secure Firewall Management Center (FMC) (generic), Cisco/Cisco Secure Firewall Threat Defense (FTD) Software (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Cisco/Cisco Secure Firewall Management Center (FMC)generic | 7.0.0 || 7.0.0.1 || 7.0.1 || 7.0.1.1 || 7.0.2 || 7.2.0 || 7.0.2.1 || 7.0.3 || 7.2.0.1 || 7.0.4 || 7.2.1 || 7.0.5 || 7.3.0 || 7.2.2 || 7.3.1 || 7.2.3 || 7.2.3.1 || 7.2.4 || 7.0.6 || 7.2.4.1 || 7.2.5 || 7.3.1.1 || 7.4.0 || 7.0.6.1 || 7.2.5.1 || 7.4.1 || 7.2.6 || 7.4.1.1 || 7.0.6.2 || 7.2.7 || 7.2.5.2 || 7.3.1.2 || 7.2.8 || 7.6.0 || 7.4.2 || 7.2.8.1 || 7.0.6.3 || 7.4.2.1 || 7.2.9 || 7.0.7 || 7.7.0 || 7.4.2.2 || 7.2.10 || 7.6.1 || 7.4.2.3 || 7.0.8 || 7.6.2 || 7.7.10 || 7.2.10.1 || 7.0.8.1 || 7.6.2.1 || 7.2.10.2 || 7.7.10.1 || 7.4.2.4 || 7.4.3 || 7.6.3 || 7.7.11 || 7.6.4 || 10.0.0 || 7.4.4 || 7.4.5 || 7.0.9 || 7.2.11 || 7.7.12 || 7.6.5 || 7.4.6 || 10.0.1 || 7.4.7 || 7.0.10 | Not reported |
| Cisco/Cisco Secure Firewall Threat Defense (FTD) Softwaregeneric | 7.0.0 || 7.0.0.1 || 7.0.1 || 7.0.1.1 || 7.0.2 || 7.2.0 || 7.0.2.1 || 7.0.3 || 7.2.0.1 || 7.0.4 || 7.2.1 || 7.0.5 || 7.3.0 || 7.2.2 || 7.2.3 || 7.3.1 || 7.2.4 || 7.0.6 || 7.2.5 || 7.2.4.1 || 7.3.1.1 || 7.4.0 || 7.0.6.1 || 7.2.5.1 || 7.4.1 || 7.2.6 || 7.0.6.2 || 7.4.1.1 || 7.2.7 || 7.2.5.2 || 7.3.1.2 || 7.2.8 || 7.6.0 || 7.4.2 || 7.2.8.1 || 7.0.6.3 || 7.4.2.1 || 7.2.9 || 7.0.7 || 7.7.0 || 7.4.2.2 || 7.2.10 || 7.6.1 || 7.4.2.3 || 7.0.8 || 7.6.2 || 7.7.10 || 7.7.11 || 7.0.8.1 || 7.6.2.1 || 7.7.10.1 || 7.4.2.4 || 7.2.10.2 || 7.4.3 || 7.6.4 || 10.0.0 || 7.4.4 || 7.0.9 || 7.2.11 || 7.4.7 || 7.0.10 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root. This vulnerability is due to improper management of the TLS certificate for the sftunnel management connection. An attacker could exploit this vulnerability by connecting to the sftunnel port using a crafted TLS certificate. A successful exploit could allow the attacker to become a registered sftunnel peer with root access. Note: The attack is successful only if the sftunnel connection is down or the attack can disrupt the sftunnel connection long enough to execute the attack.
Quoted source text, attributed separately from HOL analysis.