CVE-2026-20079

Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

Published: Mar 4, 2026Updated: Sep 16, 2026 Sources: CVE List NVD BDUCWE-288

10.0CRITICAL

Description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

In plain language

AI Act now

CVE-2026-20079 is a critical Cisco Secure Firewall Management Center flaw where an attacker can remotely bypass login and run code as root—so if your business uses Cisco FMC, you should treat this as an emergency to patch.

Executive summary

CVE-2026-20079 is an unauthenticated remote authentication-bypass leading to remote code execution as root on Cisco Secure Firewall Management Center (FMC) by abusing a boot-time system process via crafted HTTP requests.

If affected, business impact

Full device takeoverComplete loss of firewall controlTheft or exposure of managed dataRansomware and persistence risk

What to do now

Check whether your business runs Cisco Secure Firewall Management Center (FMC) and whether the boot-time process described by Cisco is active on that appliance.
Compare your FMC software version and configuration against Cisco’s guidance for CVE-2026-20079 (use the official advisory below).
Patch or upgrade FMC using Cisco’s remediation steps from the advisory link, and confirm the update is applied on every affected device (including any HA pairs).
If you cannot patch immediately, follow Cisco’s interim mitigations from the same advisory and restrict access to the FMC web interface as instructed there.
After updating/mitigating, review system and web access logs for signs consistent with exploitation (notably requests tied to the exploit activity described by Cisco).

Some work to apply

What is it

Think of Cisco Secure Firewall Management Center like the “control room” that manages the security rules for your network appliances. This vulnerability lets an attacker skip the usual login and send special web requests that can run commands with the highest permissions on the system. In plain terms, it can turn your management server into a fully compromised machine that’s capable of changing security settings, stealing data, or staying hidden.

Who is affected

This matters if your business uses Cisco Secure Firewall Management Center (FMC) to manage or administer your network security devices.

It is reachable remotely using HTTP requests and does not require an attacker to have a valid account. The risk is tied to whether the vulnerable boot-time process is active on the device (for your specific installation/configuration).

How urgent is it

This is RED because exploitation has been reported in the real world, and attackers can remotely bypass authentication and gain root-level code execution. When this kind of flaw is actively used, waiting increases the chance an attacker finds your system first.

Cisco and CISA have provided time-bound mitigation expectations (mitigation mandated by August 1, 2026), which matches the very high risk level of this issue.

What to do — in detail

Confirm exposure

Inventory your systems: identify every instance of Cisco Secure Firewall Management Center (FMC) in use (including any redundant/HA deployments).
Check software version and role: for each FMC, confirm the installed FMC software version and whether it is actively running the boot-time process component Cisco calls out in the advisory.
Check network exposure: determine whether the FMC web interface is reachable from untrusted networks (for example, the public internet, VPN endpoints, or other networks where an attacker could reach HTTP).

Patch (primary remediation)

Follow Cisco’s official remediation guidance for CVE-2026-20079 using the advisory link provided below.
Apply the upgrade/patch exactly as directed by Cisco (the advisory includes the fixed versions and any required upgrade steps). Make sure the update is applied to every affected FMC device.
Validate after upgrade: confirm the device reports the intended updated software state per Cisco guidance.

If patching is delayed

Implement the interim mitigations from Cisco’s advisory (for example, access restrictions for the FMC web interface). If Cisco specifies disabling or limiting the vulnerable reachability path, apply that immediately.
Reduce exposure: restrict inbound access so the FMC management web interface is not reachable from places an attacker could access.

Detection / what to look for

Review logs around the time of any suspicious activity for patterns consistent with exploitation reported by Cisco. The NEWS finding references exploitation activity that includes execution of package_info.pl with '/var/tmp/license.tmp' in the observed workflow.
If you find indicators, treat the device as potentially compromised: isolate the FMC from the network and follow incident response steps appropriate to your environment.

Time pressure

CISA issued an alert and mandated mitigation by August 1, 2026 (per the NEWS finding).

Technical context

Severity/impact: The reported weakness enables an attacker to execute arbitrary code as root on Cisco Secure Firewall Management Center (FMC) through remote HTTP requests, with no authentication and no user interaction.

Mechanism: Exploitation leverages an improper system process created at boot time. By sending crafted HTTP requests, an unauthenticated attacker can bypass authentication and trigger execution of scripts/commands, resulting in root-level access.

Exploitation status: Real-world exploitation has been reported (NEWS finding). Public exploit code is available (EXPLOIT finding).

Weakness type: CWE-288 (authentication bypass).

KEV status: The findings include inconsistency—one digest notes “KEV not listed,” while the NEWS finding states that CISA added the flaw to its KEV catalog and mandated mitigation by August 1, 2026. Regardless, CISA’s time-bound mitigation expectation is captured in the NEWS finding.

Exploit maturity: With public exploits available and exploitation reported, this is actively weaponized.

References: Use Cisco’s advisory for the authoritative fixed versions and mitigation steps: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-288

Affected Products

Cisco Systems Inc.

commercial·USaka Cisco, cisco systems

Cisco Secure Firewall Management Center (FMC)

Networking Infrastructure

Cisco Secure Firewall Management Center

Networking Infrastructure

secure firewall management center

Networking Infrastructure

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Sep 9, 2026

Remediation due:Sep 12, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Is your org exposed to CVE-2026-20079?Discuss checks for your systems with a specialist. Scope agreed before testing. Check my exposure