CVE-2026-20079
published 2026-03-04CVE-2026-20079: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-12
Exploited in the wild
EPSS
88.47%
99.8th percentile
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Affected
145 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
| cisco | cisco_secure_firewall_management_center | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlGET /help/about.cgi HTTP/1.1
cookieCGISESSID=csm_processes
path/help/about.cgi
otherhtml:"BackdraftSyncIntegration"
- →Authentication bypass is triggered by sending a crafted HTTP GET request to /help/about.cgi with the cookie CGISESSID=csm_processes. A 200 response containing 'Cisco Secure Firewall Management Center', 'Model', 'OS', and 'Hostname' confirms successful bypass.
- →Without the magic cookie, the endpoint returns HTTP 302 with body containing 'Invalid session ID'. With the cookie CGISESSID=csm_processes, the endpoint returns HTTP 200 with device info, confirming unauthenticated access.
- →Shodan fingerprint for exposed Cisco FMC instances vulnerable to CVE-2026-20079 uses the HTML string 'BackdraftSyncIntegration'.
- →The vulnerability is rooted in an improper system process created at boot time; detection should focus on anomalous unauthenticated HTTP requests to CGI endpoints on Cisco FMC web interfaces. ↗
- ·No workarounds are available for this vulnerability; patching is the only remediation. ↗
- ·At time of advisory publication, Cisco PSIRT had no evidence of active exploitation or public PoC code. ↗
- ·The Nuclei template uses a two-step flow: first confirm the endpoint redirects unauthenticated requests (HTTP 302 + 'Invalid session ID'), then confirm bypass succeeds with the magic cookie (HTTP 200 + device info strings). Both conditions must be met for a verified positive.
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_cisco10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cisco Secure Firewall Management Center up to 7.7.11 Web Interface authentication bypass (cisco-sa-onprem-fmc-authbypass-5JPp45V2 / EUVD-2026-9438)
vuldb·2026-08-01·CVSS 10.0
CVE-2026-20079 [CRITICAL] Cisco Secure Firewall Management Center up to 7.7.11 Web Interface authentication bypass (cisco-sa-onprem-fmc-authbypass-5JPp45V2 / EUVD-2026-9438)
A vulnerability classified as critical was found in Cisco Secure Firewall Management Center. This affects an unknown part of the component Web Interface. The manipulation results in authentication bypass using alternate channel.
This vulnerability was named CVE-2026-20079. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
GHSA
GHSA-mv8w-c2qv-cgrg: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypa
ghsa_unreviewed·2026-03-04
CVE-2026-20079 [CRITICAL] CWE-288 GHSA-mv8w-c2qv-cgrg: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypa
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
VulnCheck
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
vulncheck·2026·CVSS 10.0
CVE-2026-20079 [CRITICAL] CWE-288 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Affected: Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Fore
CISA
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
cisa·2026-09-09·CVSS 10.0
CVE-2026-20079 [CRITICAL] CWE-288 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Vulnerability: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Affected: Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance an
Cisco
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
vendor_cisco·2026-03-05·CVSS 10.0
CVE-2026-20079 [CRITICAL] CWE-288 Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerabili
Cisco
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2026-20079 Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
CVE-2026-20079: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-288, CWE-
No detection rules found.
Metasploit
Cisco Secure Firewall Management Center Authentication Bypass RCE
metasploit·CVSS 10.0
CVE-2026-20079 [CRITICAL] Cisco Secure Firewall Management Center Authentication Bypass RCE
Cisco Secure Firewall Management Center Authentication Bypass RCE
This module exploits CVE-2026-20079, an authentication bypass in the web interface of Cisco Secure Firewall Management Center (FMC). It upgrades a boot-created machine session, obtains its session-specific action token, writes a Makeself-compatible shell script, and executes the selected command payload as root. Exploitation requires the transient csm_processes startup session to still exist. Normal authenticated activity or session cleanup may remove that session, so an affected appliance may not be exploitable at the time of testing. The underlying request sequence and FIFO/netcat payload were tested against Cisco Secure FMC 10.0.1-1.
Nuclei
Cisco Secure Firewall Management Center - Authentication Bypass
nuclei·CVSS 10.0
CVE-2026-20079 [CRITICAL] Cisco Secure Firewall Management Center - Authentication Bypass
Cisco Secure Firewall Management Center - Authentication Bypass
Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.
Template:
id: CVE-2026-20079
info:
name: Cisco Secure Firewall Management Center - Authentication Bypass
author: theamanrawat
severity: critical
description: |
Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.
impact: |
Unauthenticated remote attackers can gain root access
Recorded Future
September 2026 CVE Landscape
blogs_recorded_future·2026-10-13·CVSS 9.8
CVE-2026-88771 [CRITICAL] September 2026 CVE Landscape
## September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and m
Hackernews
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
blogs_hackernews·2026-09-17
CVE-2026-59310 ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them.
This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough.
So the threat landscape is not getting cleaner. It is just getting more places to make the same mistake. Here’s what showed up this week.
The threats change every week. Subscribe, and we’ll alert you wh
Hackernews
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
blogs_hackernews·2026-09-11·CVSS 10.0
CVE-2026-20079 [CRITICAL] Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities.
The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
The second flaw under exploitation is
Rapid7
Metasploit Wrap Up: This One Goes to Sixteen!
blogs_rapid7·2026-09-11·CVSS 8.4
CVE-2025-66516 [HIGH] Metasploit Wrap Up: This One Goes to Sixteen!
## This One Goes to Sixteen!
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
## New module content (16)
## Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read
Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon
Type: Auxiliary
Pull request: #21739 contributed by kmkz
Path: scanner/http/elasticsearch_tika_xfa_xxe
CVE reference: CVE-2025-66516
Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed thro
Hackernews
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
blogs_hackernews·2026-09-10·CVSS 9.8
CVE-2026-20079 [CRITICAL] CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 12, 2026.
The vulnerabilities are listed below -
CVE-2026-20079 (CVSS score: 10.0) - An authentication bypass vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote atta
Talos
We've got one word for it, and it's usually the wrong one
blogs_talos·2026-09-10
CVE-2026-20079 We've got one word for it, and it's usually the wrong one
## We've got one word for it, and it's usually the wrong one
Welcome to this week’s edition of the Threat Source newsletter.
Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine word, in and of itself. It’s easy to reach for, understandable to everyone… and it's the wrong one, most of the time.
So, story time. Last year I gave an interview with the amazing Hazel Burton about VPNFilter, and my run-in with burnout . I was a manager during that time, and it took a toll on me and on the people around me, and when it was over I didn't have language for what had happened. Neither did my peers. Neither did my leadership. Nobody was withholding help from me… we just didn't have the words.
Enter this summer, and I
Talos
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
blogs_talos·2026-09-09·CVSS 10.0
CVE-2026-20079 [CRITICAL] Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
## Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, CVE-2026-20316 is a vulnerability that allows a remote attacker to log in using a low-privileged account.
CVE-2026-20079 is a critical vulnerability with a CVSS score of 10.0. Customers are strongly advised to follow Cisco’s guidance provided in the security advisory and apply the
Hackernews
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
blogs_hackernews·2026-07-30·CVSS 5.3
CVE-2026-20316 [MEDIUM] Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of zero-day exploitation.
The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an unauthenticated, remote attacker to log in to an affected device using a low-privilege account to access sensitive data within susceptible systems.
"This vulnerability is due to the pres
Bleepingcomputer
Cisco flags more SD-WAN flaws as actively exploited in attacks
blogs_bleepingcomputer·2026-03-05·CVSS 5.4
[MEDIUM] Cisco flags more SD-WAN flaws as actively exploited in attacks
## Cisco flags more SD-WAN flaws as actively exploited in attacks
## Sergiu Gatlan
Cisco has flagged two Catalyst SD-WAN Manager security flaws as actively exploited in the wild, urging administrators to upgrade vulnerable devices.
Catalyst SD-WAN Manager (formerly vManage) is network management software that enables admins to monitor and manage up to 6,000 Catalyst SD-WAN devices from a single centralized dashboard.
"In March 2026, the Cisco PSIRT became aware of active exploitation of the vulnerabilities that are described in CVE-2026-20128 and CVE-2026-20122 only," the company warned in an update to a February 25 advisory.
"The vulnerabilities that are described in the other CVEs in this advisory are not known to have been compromised. Cisco strongly recommends that customers upgr
Bleepingcomputer
Cisco warns of max severity Secure FMC flaws giving root access
blogs_bleepingcomputer·2026-03-04·CVSS 10.0
[CRITICAL] Cisco warns of max severity Secure FMC flaws giving root access
## Cisco warns of max severity Secure FMC flaws giving root access
## Sergiu Gatlan
Cisco has released security updates to patch two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) software.
Secure FMC is a web or SSH-based interface for admins to manage Cisco firewalls and configure application control, intrusion prevention, URL filtering, and advanced malware protection.
Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw ( CVE-2026-20079 ) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability ( CVE-2026-20131 ) lets them execute arbitrary Java code as root on unpatched devices.
"An attacker could exploit this vulnerability by
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2http://seclists.org/fulldisclosure/2026/Aug/80https://blog.talosintelligence.com/fmc-ongoing-exploitation/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079
2026-03-04
Published
2026-09-09
Added to CISA KEV
Exploited in the wild