Cisco Secure Firewall Management Center Authentication Bypass (CVE-2026-20079)

Cisco says a flaw in the web interface of Cisco Secure Firewall Management Center (FMC) Software lets an unauthenticated, remote attacker bypass authentication and execute script files on the device. The attacker obtains root access to the underlying operating system. Cisco rates it CVSS 3.1 10.0 Critical.

FMC is the management console for Cisco Secure Firewall devices. Cisco says the flaw affects FMC Software and Cisco Security Cloud Control (SCC) Firewall Management regardless of device configuration. SCC Firewall Management is a SaaS offering, and Cisco says it has already deployed the fix there.

Why a Boot-Time Process Opens the Door

Cisco attributes the flaw to an improper system process that is created at boot time. An attacker sends crafted HTTP requests to the device, and a successful exploit can run scripts and commands that give root access. Cisco notes that the attack surface is smaller when the FMC management interface has no public internet access.

VulnCheck built a working exploit and published its analysis on 26 March 2026. It says the startup process leaves a partial session in the FMC database. If nobody authenticates after boot, that session persists, and an attacker can upgrade it into one with usable permissions.

VulnCheck also says the bypass has prerequisites. The host must have rebooted, and normal activity such as user logins or dashboard use can clear the session. It concludes that a target is likely exploitable only shortly after boot, or on systems that rarely see web interface activity.

Do not read those prerequisites as a safe state. Cisco lists the flaw as affecting FMC regardless of configuration, and both Cisco and CISA report exploitation. VulnCheck cites about 300 FMC instances on the public internet in Censys and 600 to 700 in FOFA.

Exploitation Signals for CVE-2026-20079

These are the public signals we checked on 4 November 2026. Each row names who says it.

The README of the earliest repository, created on 28 March, is an overview of the flaw. The second, created on 17 August, says it holds a Python proof of concept that implements the request sequence VulnCheck published. The third says it is a read-only checker without the exploit steps. We do not link them.

On 20 August 2026 a researcher posted to the Full Disclosure mailing list that the public chain was independently reproduced on FMC 10.0.1-1 with confirmed root execution. The post says the work does not claim discovery of the flaw. It points to a write-up dated 15 August by Arian Eidizadeh.

Most Blackhole posts are Telegram and forum items from 9 to 15 September that repeat news of the CISA listing and Cisco's confirmation.

How to Check for Signs of Exploitation

Cisco gives one check. In expert mode, run zgrep "package_info.*license" on the messages logs. If the output includes /var/tmp/license.tmp, Cisco says the device may have been exploited.

Cisco says its hot fixes are for preventing future exploitation and may not address an existing compromise. If you suspect exploitation, contact Cisco TAC for recovery options. Cisco says Brandon Sakai of Cisco found the flaw during internal security testing.

Cisco's firewall line has had other recent flaws, such as the Cisco ASA and FTD flaw CVE-2026-76418. Our Cisco vulnerability tracker lists more Cisco advisories.

Cisco says the flaw affects Secure Firewall Management Center Software and Cisco Security Cloud Control (SCC) Firewall Management, regardless of configuration. NVD lists FMC releases from 7.0.0 up to 10.0.1, including 7.1 and 7.3 releases that have no row of their own in Cisco's table. The table below follows Cisco's fixed-release table row by row.

Cisco says it first provided hot fixes. It has since published hardening releases that include this fix and several other internally found fixes, and it recommends upgrading to the matching hardening release. Customers who need details on the old hot fixes should contact Cisco TAC.

Cisco confirms that these products are not affected: Firewall Device Manager (FDM), Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software and Security Cloud Control (SCC), formerly Defense Orchestrator. Cisco lists no workaround. Its Software Checker tool shows which advisories apply to a given release.

Cisco published the advisory on 4 March 2026 in its March 2026 bundled publication for Secure Firewall ASA, FMC and FTD. It last updated the advisory on 16 September 2026. Our vulnerability management guide covers how to plan and check a rollout.