Critical vulnerabilities in Cisco Secure Firewall and Catalyst SD-WAN Manager

Since 4 March 2026, Cisco has published several security advisories covering critical vulnerabilities in Cisco Secure Firewall Management Center and Cisco Catalyst SD-WAN Manager. One of the most severe, CVE-2026-20131, affects Secure FMC and could let an unauthenticated remote attacker execute arbitrary Java code with root privileges through the web-based management interface. In Catalyst SD-WAN Manager, CVE-2026-20129, with a CVSS score of 9.8, could allow an unauthenticated attacker to bypass authentication and obtain netadmin-level access. Further flaws in the same platform could enable privilege escalation, information disclosure or arbitrary file overwrite. Cisco has released updates and advises restricting access to management interfaces.

What this means for your business

These are not flaws in an application but in the tools that govern the network. An attacker with netadmin access to firewall management can open traffic paths, disable logging and make themselves invisible to the rest of your monitoring. Because the attack requires no authentication, mere reachability of the interface is enough. For organisations under NIS2, this is a textbook case where an unaddressed flaw in security infrastructure is hard to defend after the fact.

Berigo recommends

• Apply Cisco's updates to FMC and Catalyst SD-WAN Manager, treating it as urgent work rather than routine maintenance.
• Verify that management interfaces are not reachable from the internet and restrict them to a dedicated operations network.
• Review configuration changes and administrator accounts for the period before the patch was applied.
• Ensure network management logs are shipped to a system the attacker cannot alter from the same platform.

Source

• sec.cloudapps.cisco.com
• sec.cloudapps.cisco.com