CVE-2026-20079criticalunder attackCWE-288

CVE-2026-20079: critical vulnerability in Cisco Secure Firewall Management Center (FMC)

Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 10epss 88%
from disclosure to weapon167 days
Published on NVDMar 4
1st PoC+167d
metasploitMar 4
CISA KEV+189d
exploitation probability
88%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 81/2026 · 10 Sep 2026Vulnerabilidade crítica que afeta o CISCO Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Managementread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-09-12

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A critical flaw in Cisco Secure Firewall Management Center allows attackers from the internet to skip login protections and gain complete control of the device by sending specially crafted requests. This is extremely serious because the attacker can run commands with the highest system privileges.

Technical detail

An improper system process initialization in the FMC web interface permits unauthenticated remote attackers to bypass authentication mechanisms via crafted HTTP requests, leading to arbitrary script execution with root privileges. The vulnerability stems from CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and affects the device at boot time, enabling full OS-level compromise.

Summary generated and translated by AI from the official description.
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure Firewall Management Center (FMC)
public PoCs found — 1
vulncheckvulncheck.com/xdb/c53c95f7b4efunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Secure Firewall Management Center (FMC)

In the same product, most dangerous first.

CVE-2026-20131CRITICALCisco Secure Firewall Management Center Software Remote Code Execution VulnerabilityEPSS 43.2%KEVCVE-2026-20316MEDIUMCisco Secure Firewall Management Center Software Static Credential VulnerabilityEPSS 35.1%KEVCVE-2026-20242CRITICALCisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-20340HIGHCisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution VulnerabilityEPSS 0.7%CVE-2026-20343HIGHCisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service VulnerabilityEPSS 0.7%CVE-2026-20324CRITICALCisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution VulnerabilityEPSS 0.6%
References
https://blog.talosintelligence.com/fmc-ongoing-exploitation/http://seclists.org/fulldisclosure/2026/Aug/80https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079