CVE-2026-20079: Cisco Secure Firewall Management Center authentication bypass to root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote root compromise of a central firewall management platform, with KEV listing, confirmed exploitation reporting and very high EPSS.

What it is

Cisco Secure Firewall Management Center (FMC) Software contains an authentication bypass caused by an improper system process created at boot time. An unauthenticated remote attacker can send crafted HTTP requests to the web interface and execute script files, gaining root access to the underlying operating system. Because FMC is a central management plane for firewall estates, compromise is severe.

Impact

An attacker gains root-level control of the FMC appliance, allowing execution of arbitrary scripts and commands. This can expose managed firewall configurations and credentials and enable further lateral movement across the managed environment.

Attack surface

Reachable over the network through the FMC web interface via crafted HTTP requests; the CVSS vector shows no privileges required and no user interaction. No authentication is needed, so any host that can reach the interface can attempt exploitation.

Exploitation

Listed in CISA KEV with a 2026-09-12 remediation due date, and references include an exploit-tagged Full Disclosure post and a Cisco Talos blog on ongoing exploitation. EPSS 30-day probability is 0.75752 (99.5th percentile), indicating high likelihood of attempted exploitation.

What to do

• Apply the vendor patch per the Cisco security advisory as the first action.
• If patching is not immediately possible, restrict network access to the FMC web interface to trusted management networks only.
• Follow CISA BOD 26-04 guidance, including evaluating internet exposure and discontinuing use if mitigations are unavailable.
• Review FMC management-plane exposure and remove any direct internet reachability.
• Monitor vendor advisory updates for revised fixed versions or interim mitigations.

Detection

• Inspect FMC HTTP access logs for crafted or anomalous requests to the web interface, especially from untrusted sources.
• Alert on unexpected script or command execution and new processes on the FMC appliance.
• Monitor for authentication-bypass patterns and anomalous root-level activity on the underlying OS.
• Hunt for outbound connections from FMC to unknown hosts that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.