CVE-2026-20001

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20001", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.348Z", "datePublished": "2026-03-04T17:03:45.756Z", "dateUpdated": "2026-03-05T15:37:40.809Z"}, "containers": {"cna": {"title": "Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.\r\n\r\nThis vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles:\r\n\r\nAdministrator\r\nSecurity approver\r\nAccess admin\r\nNetwork admin"}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd", "name": "cisco-sa-fmc-sql-injection-2qH6CcJd"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-fmc-sql-injection-2qH6CcJd", "discovery": "INTERNAL", "defects": ["CSCwo65318"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "cwe", "cweId": "CWE-89"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "versions": [{"version": "7.0.0", "status": "affected"}, {"version": "7.0.0.1", "status": "affected"}, {"version": "7.0.1", "status": "affected"}, {"version": "7.1.0", "status": "affected"}, {"version": "7.0.1.1", "status": "affected"}, {"version": "7.1.0.1", "status": "affected"}, {"version": "7.0.2", "status": "affected"}, {"version": "7.2.0", "status": "affected"}, {"version": "7.0.2.1", "status": "affected"}, {"version": "7.0.3", "status": "affected"}, {"version": "7.1.0.2", "status": "affected"}, {"version": "7.2.0.1", "status": "affected"}, {"version": "7.0.4", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.0.5", "status": "affected"}, {"version": "7.3.0", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.2.3", "status": "affected"}, {"version": "7.1.0.3", "status": "affected"}, {"version": "7.2.3.1", "status": "affected"}, {"version": "7.2.4", "status": "affected"}, {"version": "7.0.6", "status": "affected"}, {"version": "7.2.4.1", "status": "affected"}, {"version": "7.2.5", "status": "affected"}, {"version": "7.3.1.1", "status": "affected"}, {"version": "7.4.0", "status": "affected"}, {"version": "7.0.6.1", "status": "affected"}, {"version": "7.2.5.1", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.6", "status": "affected"}, {"version": "7.4.1.1", "status": "affected"}, {"version": "7.0.6.2", "status": "affected"}, {"version": "7.2.7", "status": "affected"}, {"version": "7.2.5.2", "status": "affected"}, {"version": "7.3.1.2", "status": "affected"}, {"version": "7.2.8", "status": "affected"}, {"version": "7.6.0", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.2.8.1", "status": "affected"}, {"version": "7.0.6.3", "status": "affected"}, {"version": "7.4.2.1", "status": "affected"}, {"version": "7.2.9", "status": "affected"}, {"version": "7.0.7", "status": "affected"}, {"version": "7.7.0", "status": "affected"}, {"version": "7.4.2.2", "status": "affected"}, {"version": "7.2.10", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.4.2.3", "status": "affected"}, {"version": "7.0.8", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.2.10.1", "status": "affected"}, {"version": "7.0.8.1", "status": "affected"}, {"version": "7.6.2.1", "status": "affected"}, {"version": "7.2.10.2", "status": "affected"}, {"version": "7.4.2.4", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:03:45.756Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:37:22.174696Z", "id": "CVE-2026-20001", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:37:40.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:37:22.174696Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:37:34.503Z"}}], "cna": {"title": "Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities", "source": {"defects": ["CSCwo65318"], "advisory": "cisco-sa-fmc-sql-injection-2qH6CcJd", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "versions": [{"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.0.0.1"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.0.1.1"}, {"status": "affected", "version": "7.1.0.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.2.1"}, {"status": "affected", "version": "7.0.3"}, {"status": "affected", "version": "7.1.0.2"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.0.4"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.0.5"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.1.0.3"}, {"status": "affected", "version": "7.2.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.0.6"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.0.6.1"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.0.6.2"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.0.6.3"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.0.7"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.0.8"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.2.10.1"}, {"status": "affected", "version": "7.0.8.1"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.4.2.4"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd", "name": "cisco-sa-fmc-sql-injection-2qH6CcJd"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.\r\n\r\nThis vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles:\r\n\r\nAdministrator\r\nSecurity approver\r\nAccess admin\r\nNetwork admin"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:03:45.756Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20001", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:37:40.809Z", "dateReserved": "2025-10-08T11:59:15.348Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:03:45.756Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Secure Firewall Management Center (FMC)", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "7.0.0.1"}, {"status": "affected", "version": "7.0.1"}, {"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.0.1.1"}, {"status": "affected", "version": "7.1.0.1"}, {"status": "affected", "version": "7.0.2"}, {"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.2.1"}, {"status": "affected", "version": "7.0.3"}, {"status": "affected", "version": "7.1.0.2"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.0.4"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.0.5"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.1.0.3"}, {"status": "affected", "version": "7.2.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.0.6"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.0.6.1"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.0.6.2"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.0.6.3"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.0.7"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.0.8"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.2.10.1"}, {"status": "affected", "version": "7.0.8.1"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.2.10.2"}, {"status": "affected", "version": "7.4.2.4"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.\r\n\r\nThis vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain read access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials with any of the following roles:\r\n\r\nAdministrator\r\nSecurity approver\r\nAccess admin\r\nNetwork admin"}, {"lang": "es", "value": "Una vulnerabilidad en la API REST de Cisco Secure FMC Software podr\u00eda permitir a un atacante remoto autenticado realizar ataques de inyecci\u00f3n SQL en un sistema afectado.\n\nEsta vulnerabilidad se debe a una validaci\u00f3n inadecuada de la entrada proporcionada por el usuario. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes manipuladas a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante obtener acceso de lectura a la base de datos y leer ciertos archivos en el sistema operativo subyacente. Para explotar esta vulnerabilidad, el atacante necesitar\u00eda credenciales de usuario v\u00e1lidas con cualquiera de los siguientes roles:\n\nAdministrador\nAprobador de seguridad\nAdministrador de acceso\nAdministrador de red"}], "id": "CVE-2026-20001", "lastModified": "2026-06-17T10:16:51.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20001", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:37:22.174696Z", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:12.243", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.10.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.10.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.4"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco Secure Firewall Management Center (FMC)", "source": "cna", "vendor": "Cisco"}, "product": "secure_firewall_management_center", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-18T10:01:46.595985+00:00", "value": {"mitigation_remediation": ["Apply the latest security update or patch issued by Cisco for the FMC software as documented in the Cisco security advisory, which fixes the CWE\u201189 SQL injection flaw.", "Restrict REST API access by enforcing the principle of least privilege\u2014remove or limit the Administrator, Security approver, Access admin, and Network admin rights for users who do not require them, and validate all user\u2011supplied input against SQL injection patterns (CWE\u201189) by using parameterized queries.", "Enable detailed logging of SQL queries and monitor for anomalous or suspicious activity on the FMC system, correlating logs with known CWE\u201189 attack signatures to detect potential exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Confidentiality Breach"}, "threat_synthesis": {"affected_systems": "Impact falls on Cisco Secure Firewall Management Center (FMC) devices; all deployments running the affected firmware are potentially vulnerable as specific product versions were not listed. The flaw requires valid user credentials with one of the following roles: Administrator, Security approver, Access admin, or Network admin, allowing these users to exploit the REST API endpoints to perform the injection.", "description_and_impact": "A vulnerable REST API in Cisco Secure FMC Software permits an authenticated remote attacker to inject SQL statements due to insufficient input validation; by sending crafted API requests, an attacker can read data from the application database and retrieve selected operating\u2011system files, which enables disclosure of sensitive configuration and data information without granting write or execution privileges.", "risk_and_exploitability": "The CVSS v3 score of 6.5 classifies the issue as moderate. EPSS indicates a current exploitation likelihood below 1%, suggesting a low probability of attacker activity presently, and the flaw is not present in CISA's KEV catalog. The attack vector is a remote, authenticated request to the REST API; an attacker must first compromise or obtain valid credentials with sufficient privileges. Successful exploitation grants read\u2011only access to the database and limited file read capabilities, posing a confidentiality risk to sensitive firewall configuration and logs."}}}}, "created": "2026-03-05T09:06:54.485688+00:00", "updated": "2026-04-18T10:15:25.861573+00:00", "vendors": ["cisco", "cisco$PRODUCT$secure_firewall_management_center"]}