⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● High · CVSS 8.1

How to Fix CVE-2026-20002: Cisco Secure Firewall Management Center (FMC) (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-20002 is a sibling vulnerability in the same vendor advisory as CVE-2026-20001. Apply the same patched build and you close both. The technical detail below is what differs.

⚡ At a glance
Severity8.1 (High)
Actively exploited?No public listing in CISA KEV
AffectedCisco Secure Firewall Management Center (FMC) 6.4.0; Cisco Secure Firewall Management Center (FMC) 6.4.0.1; Cisco Secure Firewall Management Center (FMC) 6.4.0.3; Cisco Secure Firewall Management Center (FMC) 6.4.0.2; Cisco Secure Firewall Management Center (FMC) 6.4.0.4; Cisco Secure Firewall Management Center (FMC) 6.4.0.5; Cisco Secure Firewall Management Center (FMC) 6.4.0.6; Cisco Secure Firewall Management Center (FMC) 6.4.0.7; Cisco Secure Firewall Management Center (FMC) 6.4.0.8; Cisco Secure Firewall Management Center (FMC) 6.4.0.9; Cisco Secure Firewall Management Center (FMC) 6.4.0.10; Cisco Secure Firewall Management Center (FMC) 6.4.0.11; Cisco Secure Firewall Management Center (FMC) 6.4.0.12; Cisco Secure Firewall Management Center (FMC) 6.4.0.13; Cisco Secure Firewall Management Center (FMC) 6.4.0.14; Cisco Secure Firewall Management Center (FMC) 6.4.0.15; Cisco Secure Firewall Management Center (FMC) 6.4.0.16; Cisco Secure Firewall Management Center (FMC) 6.4.0.17; Cisco Secure Firewall Management Center (FMC) 6.4.0.18; Cisco Secure Firewall Management Center (FMC) 7.0.0; Cisco Secure Firewall Management Center (FMC) 7.0.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1.1; Cisco Secure Firewall Management Center (FMC) 7.0.2; Cisco Secure Firewall Management Center (FMC) 7.0.2.1; Cisco Secure Firewall Management Center (FMC) 7.0.3; Cisco Secure Firewall Management Center (FMC) 7.0.4; Cisco Secure Firewall Management Center (FMC) 7.0.5; Cisco Secure Firewall Management Center (FMC) 7.0.6; Cisco Secure Firewall Management Center (FMC) 7.0.6.1; Cisco Secure Firewall Management Center (FMC) 7.0.6.2; Cisco Secure Firewall Management Center (FMC) 7.0.6.3; Cisco Secure Firewall Management Center (FMC) 7.0.7; Cisco Secure Firewall Management Center (FMC) 7.0.8; Cisco Secure Firewall Management Center (FMC) 7.0.8.1; Cisco Secure Firewall Management Center (FMC) 7.1.0; Cisco Secure Firewall Management Center (FMC) 7.1.0.1; Cisco Secure Firewall Management Center (FMC) 7.1.0.2; Cisco Secure Firewall Management Center (FMC) 7.1.0.3; Cisco Secure Firewall Management Center (FMC) 7.2.0; Cisco Secure Firewall Management Center (FMC) 7.2.1; Cisco Secure Firewall Management Center (FMC) 7.2.2; Cisco Secure Firewall Management Center (FMC) 7.2.0.1; Cisco Secure Firewall Management Center (FMC) 7.2.3; Cisco Secure Firewall Management Center (FMC) 7.2.3.1; Cisco Secure Firewall Management Center (FMC) 7.2.4; Cisco Secure Firewall Management Center (FMC) 7.2.4.1; Cisco Secure Firewall Management Center (FMC) 7.2.5; Cisco Secure Firewall Management Center (FMC) 7.2.5.1; Cisco Secure Firewall Management Center (FMC) 7.2.6; Cisco Secure Firewall Management Center (FMC) 7.2.7; Cisco Secure Firewall Management Center (FMC) 7.2.5.2; Cisco Secure Firewall Management Center (FMC) 7.2.8; Cisco Secure Firewall Management Center (FMC) 7.2.8.1; Cisco Secure Firewall Management Center (FMC) 7.2.9; Cisco Secure Firewall Management Center (FMC) 7.2.10; Cisco Secure Firewall Management Center (FMC) 7.2.10.2; Cisco Secure Firewall Management Center (FMC) 7.2.10.1; Cisco Secure Firewall Management Center (FMC) 7.3.0; Cisco Secure Firewall Management Center (FMC) 7.3.1; Cisco Secure Firewall Management Center (FMC) 7.3.1.1; Cisco Secure Firewall Management Center (FMC) 7.3.1.2; Cisco Secure Firewall Management Center (FMC) 7.4.0; Cisco Secure Firewall Management Center (FMC) 7.4.1; Cisco Secure Firewall Management Center (FMC) 7.4.1.1; Cisco Secure Firewall Management Center (FMC) 7.4.2; Cisco Secure Firewall Management Center (FMC) 7.4.2.1; Cisco Secure Firewall Management Center (FMC) 7.4.2.2; Cisco Secure Firewall Management Center (FMC) 7.4.2.3; Cisco Secure Firewall Management Center (FMC) 7.4.2.4; Cisco Secure Firewall Management Center (FMC) 7.4.3; Cisco Secure Firewall Management Center (FMC) 7.6.0; Cisco Secure Firewall Management Center (FMC) 7.6.1; Cisco Secure Firewall Management Center (FMC) 7.6.2; Cisco Secure Firewall Management Center (FMC) 7.6.2.1; Cisco Secure Firewall Management Center (FMC) 7.6.3; Cisco Secure Firewall Management Center (FMC) 7.7.0; Cisco Secure Firewall Management Center (FMC) 7.7.10; Cisco Secure Firewall Management Center (FMC) 7.7.10.1
Fixed inSame patched build as CVE-2026-20001
Type (CWE)CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

What's different about CVE-2026-20002?

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

This vulnerability is due to inadequate validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted requests to an affected device. A successful exploit could allow the attacker to obtain full access to the database and read certain files on the underlying operating system. To exploit this vulnerability, the attacker would need valid user credentials.

How to fix CVE-2026-20002

Apply the patched build per the primary write-up: How to Fix CVE-2026-20001. All commands, verification steps, and rollback notes for Cisco Secure Firewall Management Center (FMC) are listed there.

Frequently asked questions

Does the CVE-2026-20001 patch close CVE-2026-20002?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-20002 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-injection-2qH6CcJd

References

*Written by Sai Kiran Pandrala. Part of the Cisco Secure Firewall Management Center (FMC) bundle. Full procedure at how-to-fix-cve-2026-20001.*