CVE-2026-20063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20063", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.356Z", "datePublished": "2026-03-04T17:48:38.176Z", "dateUpdated": "2026-03-05T04:55:51.683Z"}, "containers": {"cna": {"title": "Cisco Secure FTD Software Authenticated Command Injection Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X", "baseScore": 6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device.\r\n\r\nThis vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for a specific CLI command. A successful exploit could allow the attacker to execute commands on the underlying operating system as root."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmd-inj-mTzGZexf", "name": "cisco-sa-ftd-cmd-inj-mTzGZexf"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-ftd-cmd-inj-mTzGZexf", "discovery": "INTERNAL", "defects": ["CSCwp81377"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "cwe", "cweId": "CWE-88"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"version": "7.6.0", "status": "affected"}, {"version": "7.7.0", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.7.10", "status": "affected"}, {"version": "7.6.2.1", "status": "affected"}, {"version": "7.7.10.1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:48:38.176Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-20063"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T04:55:51.683Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T21:00:49.266760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:00:54.666Z"}}], "cna": {"title": "Cisco Secure FTD Software Authenticated Command Injection Vulnerability", "source": {"defects": ["CSCwp81377"], "advisory": "cisco-sa-ftd-cmd-inj-mTzGZexf", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:X/RL:X/RC:X", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.10.1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmd-inj-mTzGZexf", "name": "cisco-sa-ftd-cmd-inj-mTzGZexf"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device.\r\n\r\nThis vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for a specific CLI command. A successful exploit could allow the attacker to execute commands on the underlying operating system as root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:48:38.176Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20063", "state": "PUBLISHED", "dateUpdated": "2026-03-05T04:55:51.683Z", "dateReserved": "2025-10-08T11:59:15.356Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:48:38.176Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.7.0"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.7.10"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.7.10.1"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device.\r\n\r\nThis vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for a specific CLI command. A successful exploit could allow the attacker to execute commands on the underlying operating system as root."}, {"lang": "es", "value": "Una vulnerabilidad en la CLI de Cisco Secure FTD Software podr\u00eda permitir a un atacante autenticado y local ejecutar comandos arbitrarios en el sistema operativo subyacente como root. Para explotar esta vulnerabilidad, el atacante debe tener credenciales administrativas v\u00e1lidas en un dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validaci\u00f3n de entrada insuficiente de los argumentos de comando proporcionados por el usuario. Un atacante podr\u00eda explotar esta vulnerabilidad al enviar entrada manipulada para un comando CLI espec\u00edfico. Un exploit exitoso podr\u00eda permitir al atacante ejecutar comandos en el sistema operativo subyacente como root."}], "id": "CVE-2026-20063", "lastModified": "2026-06-17T10:17:00.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20063", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:21.170", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmd-inj-mTzGZexf"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.7.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.7.10.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cisco Secure Firewall Threat Defense (FTD) Software", "source": "cna", "vendor": "Cisco"}, "product": "secure_firewall_threat_defense", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-17T13:05:27.036544+00:00", "value": {"mitigation_remediation": ["Install the latest Cisco Secure FTD Software patch that resolves the CLI command injection flaw.", "If patching is not immediately possible, restrict CLI access to a narrow set of trusted administrators and enforce strong authentication policies, such as multi\u2011factor authentication.", "Enable comprehensive logging and monitoring of CLI command usage to detect suspicious activity, and consider disabling or limiting the vulnerable command if feasible."], "summary": {"action": "Apply Patch", "impact": "Root Command Injection"}, "threat_synthesis": {"affected_systems": "Affected systems include Cisco Secure Firewall Threat Defense (FTD) Software installations. No specific version range is disclosed in the advisory, so all deployed FTD installations that have not applied any subsequent patch are potentially vulnerable. Administrators should verify whether their devices are running the affected build and check the vendor\u2019s portal for the latest firmware or software update that remediates the issue.", "description_and_impact": "The vulnerability resides in the command line interface of Cisco Secure FTD Software, where insufficient validation of CLI command arguments permits an authenticated, local user to inject arbitrary commands that are executed on the device\u2019s underlying operating system with root privileges. An attacker must have valid administrative credentials to exploit this flaw. The CVE description identifies the risk of executing arbitrary commands as root on the device, which could compromise the device\u2019s confidentiality, integrity, and availability.", "risk_and_exploitability": "The advisory assigns a medium CVSS score of 6.0 and an EPSS probability of less than 1\u202f%, indicating a relatively low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, because an attacker must first obtain administrative credentials, the threat is confined to privileged users or to situations where credentials can be compromised. If successful, the attacker can command the operating system as root, which carries a high impact on confidentiality, integrity, and availability of the network defended by the device."}}}}, "created": "2026-03-05T09:06:15.389017+00:00", "updated": "2026-04-17T13:15:19.658968+00:00", "vendors": ["cisco", "cisco$PRODUCT$secure_firewall_threat_defense"]}