CVE-2026-20079: cisco secure_firewall_management_center

CVSS 10.0 (critical) · listed as exploited by CISA since 2026-09-09 · published 2026-03-04

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

Affected products (NVD): cisco secure_firewall_management_center

Weakness: CWE-288

Source: NVD CVE-2026-20079

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
• http://seclists.org/fulldisclosure/2026/Aug/80
• https://blog.talosintelligence.com/fmc-ongoing-exploitation/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.