CVE-2026-20079

Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

Exploited in the wild. In CISA KEV since 2026‑09‑09. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile99th88% chance in 30 days CISA KEVListedsince 2026-09-09, due 2026-09-12
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2026-03-04Updated 2026-09-16Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your business runs Cisco Secure Firewall Management Center (FMC) and whether the boot-time process described by Cisco is active on that appliance.
Compare your FMC software version and configuration against Cisco’s guidance for CVE-2026-20079 (use the official advisory below).
Patch or upgrade FMC using Cisco’s remediation steps from the advisory link, and confirm the update is applied on every affected device (including any HA pairs).
If you cannot patch immediately, follow Cisco’s interim mitigations from the same advisory and restrict access to the FMC web interface as instructed there.
After updating/mitigating, review system and web access logs for signs consistent with exploitation (notably requests tied to the exploit activity described by Cisco).

Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

In plain language

Written by AI from the record

CVE-2026-20079 is a critical Cisco Secure Firewall Management Center flaw where an attacker can remotely bypass login and run code as root—so if your business uses Cisco FMC, you should treat this as an emergency to patch.

CVE-2026-20079 is an unauthenticated remote authentication-bypass leading to remote code execution as root on Cisco Secure Firewall Management Center (FMC) by abusing a boot-time system process via crafted HTTP requests.

If you're affected

Full device takeover
Complete loss of firewall control
Theft or exposure of managed data
Ransomware and persistence risk

What is it

Think of Cisco Secure Firewall Management Center like the “control room” that manages the security rules for your network appliances. This vulnerability lets an attacker skip the usual login and send special web requests that can run commands with the highest permissions on the system. In plain terms, it can turn your management server into a fully compromised machine that’s capable of changing security settings, stealing data, or staying hidden.

Who is affected

This matters if your business uses Cisco Secure Firewall Management Center (FMC) to manage or administer your network security devices.

It is reachable remotely using HTTP requests and does not require an attacker to have a valid account. The risk is tied to whether the vulnerable boot-time process is active on the device (for your specific installation/configuration).

How urgent is it

This is RED because exploitation has been reported in the real world, and attackers can remotely bypass authentication and gain root-level code execution. When this kind of flaw is actively used, waiting increases the chance an attacker finds your system first.

Cisco and CISA have provided time-bound mitigation expectations (mitigation mandated by August 1, 2026), which matches the very high risk level of this issue.

What to do — in detail

Confirm exposure

Inventory your systems: identify every instance of Cisco Secure Firewall Management Center (FMC) in use (including any redundant/HA deployments).
Check software version and role: for each FMC, confirm the installed FMC software version and whether it is actively running the boot-time process component Cisco calls out in the advisory.
Check network exposure: determine whether the FMC web interface is reachable from untrusted networks (for example, the public internet, VPN endpoints, or other networks where an attacker could reach HTTP).

Patch (primary remediation)

Follow Cisco’s official remediation guidance for CVE-2026-20079 using the advisory link provided below.
Apply the upgrade/patch exactly as directed by Cisco (the advisory includes the fixed versions and any required upgrade steps). Make sure the update is applied to every affected FMC device.
Validate after upgrade: confirm the device reports the intended updated software state per Cisco guidance.

If patching is delayed

Implement the interim mitigations from Cisco’s advisory (for example, access restrictions for the FMC web interface). If Cisco specifies disabling or limiting the vulnerable reachability path, apply that immediately.
Reduce exposure: restrict inbound access so the FMC management web interface is not reachable from places an attacker could access.

Detection / what to look for

Review logs around the time of any suspicious activity for patterns consistent with exploitation reported by Cisco. The NEWS finding references exploitation activity that includes execution of package_info.pl with '/var/tmp/license.tmp' in the observed workflow.
If you find indicators, treat the device as potentially compromised: isolate the FMC from the network and follow incident response steps appropriate to your environment.

Time pressure

CISA issued an alert and mandated mitigation by August 1, 2026 (per the NEWS finding).

Technical context

Severity/impact: The reported weakness enables an attacker to execute arbitrary code as root on Cisco Secure Firewall Management Center (FMC) through remote HTTP requests, with no authentication and no user interaction.

Mechanism: Exploitation leverages an improper system process created at boot time. By sending crafted HTTP requests, an unauthenticated attacker can bypass authentication and trigger execution of scripts/commands, resulting in root-level access.

Exploitation status: Real-world exploitation has been reported (NEWS finding). Public exploit code is available (EXPLOIT finding).

Weakness type: CWE-288 (authentication bypass).

KEV status: The findings include inconsistency—one digest notes “KEV not listed,” while the NEWS finding states that CISA added the flaw to its KEV catalog and mandated mitigation by August 1, 2026. Regardless, CISA’s time-bound mitigation expectation is captured in the NEWS finding.

Exploit maturity: With public exploits available and exploitation reported, this is actively weaponized.

References: Use Cisco’s advisory for the authoritative fixed versions and mitigation steps: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-09-09.

US federal agencies must remediate by 2026-09-12.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

88% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

27 events over 205 days, from the signal feeds we watch.

2026-09-25Analysis publishedCisco's Firewall Manager Just Logged Its Third CISA KEV of 2026. This Time, Three Different Attackers Got There First.
2026-09-16Patch availablerecord updated
2026-09-12EPSS band changemoderate → high
2026-09-10EPSS band changemoderate → highepss band change, patch available, patch available, record updated, record updated
2026-09-09Added to CISA KEVpatch available, patch available, record updated, record updated
2026-08-26Patch availablerecord updated

Affected products

Cisco Systems Inc.commercial · USaka Cisco, cisco systems

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable