An insecure deserialization flaw in the web‑based management interface of Cisco Secure Firewall Management Center (FMC) allows an unauthenticated, remote attacker to send a crafted serialized Java object and execute arbitrary Java code with root privileges. The vulnerability, designated CWE‑502, can lead to full system compromise, giving attackers control over the device, data exfiltration, and further lateral movement within the network.

Affected systems include Cisco Secure Firewall Management Center (FMC) software across multiple releases, from version 6.4.0.13 through 7.7.11. The vulnerable components reside in the web‑based management interface of each affected FMC deployment.

The CVSS score of 10 indicates a critical impact. EPSS indicates a low probability (<1%) of exploitation in the general population, but the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that adversaries have leveraged it in the wild. Because the attack surface is minimized if the FMC interface lacks public internet exposure, the practical risk for internal‑only deployments is lower, yet any remote access path still represents a significant threat.