SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20242

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score35/100 — MITTEL
  • CVSS 9.8 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream from a host that is configured in the external database access list. An attacker could exploit this vulnerability by sending a crafted, serialized Java byte stream to a specific TCP port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges to root. Notes: This vulnerability can be exploited only by an attacker who has control of a host in the external database access list. If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "java" and InitiatingProcessCommandLine contains "deserialize"
| where ProcessCommandLine contains "root" or ProcessCommandLine contains "/bin/sh" or ProcessCommandLine contains "/bin/bash"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath

Splunk SPL

index=* (sourcetype=linux_audit OR sourcetype=syslog) (process="java" AND commandline="*deserialize*") (commandline="*root*" OR commandline="*/bin/sh*" OR commandline="*/bin/bash*") | table _time, host, process, commandline

Sigma

title: Cisco FMC Java Deserialization RCE
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation of Cisco Secure Firewall Management Center Java Deserialization vulnerability.
author: SecBoard
date: 2026/09/16
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: 'java'
    CommandLine|contains|all:
      - 'deserialize'
    CommandLine|contains:
      - 'root'
      - '/bin/sh'
      - '/bin/bash'
  condition: selection
falsepositives:
  - Legitimate Java applications performing deserialization (requires tuning)
level: high

Elastic ES|QL

from process where process.parent.executable == "java" and process.args contains "deserialize" and (process.args contains "root" or process.args contains "/bin/sh" or process.args contains "/bin/bash") | select @timestamp, host.name, process.parent.command_line, process.command_line, process.executable, process.working_directory

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen