🔴 CVE-2026-20079

CVE-2026-20079 is a critical (CVSS 10.0) authentication bypass and remote code execution vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC). An unauthenticated remote attacker can send crafted HTTP requests to obtain root access to the underlying OS. It is actively exploited in the wild (linked to Qilin ransomware) and listed in CISA KEV.

← Back to Overview
HIGH_RISK
Risk Level
10.0
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
MEDIUM
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-03-04

Added to CISA KEV: 2026-09-09 189 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-20079 is a critical authentication bypass and remote code execution vulnerability residing in the web interface of Cisco Secure Firewall Management Center (FMC) Software. The flaw, caused by an improper system process created at boot time, allows unauthenticated, remote attackers to circumvent authentication controls and execute arbitrary script files on the target device. This vulnerability is highly significant because it grants attackers root-level access to the underlying operating system, providing complete control over the management appliance.

Exploitation

  • Active Exploitation: The vulnerability is being actively exploited in the wild, with reports linking its usage to the deployment of the Qilin ransomware [1].
  • Threat Actors: Known threat actors are leveraging this flaw to steal credentials and facilitate further malicious activity, including ransomware deployment [1].
  • PoC/Exploit Availability: Publicly available information and research indicate that exploit vectors exist, and the vulnerability has been utilized in ongoing campaigns tracked by security researchers [6][7].
  • Attack Prerequisites: This is a remote, network-based attack that requires no authentication and no user interaction, making it highly attractive to attackers targeting internet-facing infrastructure [2][3].

Affected Products & Patches

  • Affected Products: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management are confirmed to be impacted [5].
  • Patches & Availability: Cisco has released security advisories and patches to address this vulnerability; organizations are strongly urged to apply the latest updates provided by Cisco to their management appliances [2].
  • Mitigations: In addition to patching, security best practices include ensuring that the management interface is not directly accessible from the public internet and is restricted to trusted management networks via VPNs or access control lists (ACLs).

Impact

  • Access & Capability: Successful exploitation results in full root-level access to the appliance's underlying operating system, allowing attackers to manipulate firewall policies, exfiltrate sensitive credentials, disable security controls, or establish persistent backdoors [1][4].
  • Business Risk: For internet-facing deployments, the business risk is critical, as it exposes the core management plane of the network security infrastructure to full compromise, potentially leading to total network subversion, large-scale data breaches, and the deployment of destructive payloads like ransomware across the internal network [1][3].

Sources

  1. Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

    The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying ope…

  2. Cisco Secure Firewall Management Center Software ...

    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, ... A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication a…

  3. Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

    Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in ...

  4. NVD-CVE-2026-20079

    CVE-2026-20079 Detail Description A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating s…

  5. CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass ...

    CVE-2026-20079 is an authentication bypass in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. Public reporting describes it as an alternate-path or alternate-channel flaw: an unauthenticated remote attacker may bypass normal login co…

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed