Actively exploitedCVSS 10.0 · CRITICAL

CVE-2026-20079Authentication Bypass and Root RCE in Cisco Secure FMC

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

View on NVD

Analysis

Cisco Secure Firewall Management Center (FMC) presenta una vulnerabilidad crítica que permite a un atacante remoto obtener acceso de root al sistema operativo sin autenticación previa. Este fallo se está explotando activamente en el mundo real mediante el envío de peticiones HTTP malintencionadas. Es fundamental que los equipos de infraestructura actualicen sus sistemas de gestión de firewalls para evitar el compromiso total de la red.

Relevant roles

ciberseguridadCloudLinuxBackend

Severity

Score: 10.0(CRITICAL)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AV: NETWORK

AC: LOW

PR: NONE

UI: NONE

S: CHANGED

C: HIGH

I: HIGH

A: HIGH

Weakness (CWE): CWE-288

CISA KEV

Added to KEV: 2026-09-09

Federal patch deadline: 2026-09-12

Known ransomware use: Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EPSS

Probability of exploitation (next 30 days): 0.7575 (75.8%)

Percentile: 99.5%

EPSS: 2026-09-12

Affects

cisco:secure_firewall_management_center

Technical description

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

Published: 3/4/2026, 6:16:24 PM

Last modified: 9/10/2026, 12:48:17 PM

References

How to read this card

Actively exploited

KEV (Known Exploited Vulnerabilities) is CISA's catalog of CVEs confirmed as actively exploited in the real world. If a CVE is on KEV, someone is already using it in attacks.

CVSS 10.0

CVSS 10.0 — the theoretical maximum severity. Remotely exploitable, no privileges required, total impact. Not yet confirmed as exploited in the wild, but patch now. Widely used software only: a 10.0 in a niche plugin does not make it here.

AI-recommended

A language model reviewed the CVE and judged that it affects widely deployed software or common developer tooling. A human on the team approved publication before it landed here.

Impact categories the AI evaluates

widely_deployed_infra — Linux kernel, OpenSSL, glibc, k8s, Docker, nginx, OpenSSH.

popular_dev_tooling — Node.js, Python, Go, React, Next.js, common npm/pip libraries.

common_consumer_software — Chrome, Firefox, Windows, macOS, popular mobile apps.

enterprise_saas — GitHub, GitLab, Atlassian, Salesforce, Cisco, Fortinet, Ivanti.

niche_software — Regional CMSs, hobby tools, rarely used libraries.

not_relevant — Vendor-specific firmware, discontinued software.

EPSS — EPSS (Exploit Prediction Scoring System) by FIRST.org estimates the probability that a CVE will be exploited in the next 30 days. Range is 0 to 1; very fresh CVEs typically score low until evidence accumulates.