Cisco Secure FMC Authentication Bypass Exploited for Root Access

Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication-bypass vulnerability in Cisco Secure Firewall Management Center Software. Remote attackers can exploit the flaw without credentials or user interaction, then execute commands as root on the underlying operating system.

The vulnerability carries the maximum CVSS 3.1 score of 10.0. Cisco published its initial advisory on March 4, 2026, and updated it on September 9, 2026, to acknowledge observed exploitation. The company says its Product Security Incident Response Team became aware of attacks in August 2026.

There are no workarounds. Administrators running affected on-premises FMC deployments should install the appropriate hot fix or move to a fixed software release, then check for evidence that exploitation has already occurred.

Crafted HTTP Requests Can Produce Root-Level Execution

CVE-2026-20079 is classified as CWE-288, an authentication-bypass weakness. Cisco attributes it to an improper system process created while the device boots.

An unauthenticated attacker with network access to the FMC web interface can send specially constructed HTTP requests that evade authentication. Successful exploitation permits the attacker to run scripts, system commands, or other executables with root privileges.

The attack requires low complexity, no existing account, and no action from an administrator. Its CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The changed-scope rating reflects the transition from the vulnerable web-facing component to control of the underlying operating system. A successful attacker could therefore access confidential information, alter the management appliance, disrupt its availability, or potentially establish persistence.

Cisco discovered the flaw during internal security testing, crediting Brandon Sakai. Although keeping the FMC management interface off the public internet reduces exposure, the vulnerability remains applicable regardless of configuration. Internal attackers or adversaries who have already gained a foothold could still reach an unpatched interface.

Cisco has not attributed the attacks to a threat actor. It has also not disclosed the initial exploitation date, targeted organizations, or actions taken after attackers obtained root access.

Secure FMC Is Affected, but Several Firewall Components Are Not

The flaw affects two management offerings:

• Cisco Secure Firewall Management Center Software
• Cisco Security Cloud Control Firewall Management

Security Cloud Control Firewall Management is a cloud-hosted service maintained by Cisco. The company says it deployed the correction through its own maintenance process, so customers do not need to patch that service.

On-premises Secure FMC installations require administrator action.

Cisco has not published a conventional affected-version range for CVE-2026-20079. Instead, its security advisory maps supported release branches to hot fixes and fixed releases. Administrators should not infer that releases absent from the hot-fix table are safe; they should use Cisco Software Checker to evaluate the exact installed version.

Cisco identifies the following products as unaffected:

• Firewall Device Manager
• Cisco Secure Firewall Adaptive Security Appliance Software
• Cisco Secure Firewall Threat Defense Software
• Security Cloud Control, formerly Defense Orchestrator

The distinction is significant because FMC manages firewall infrastructure, but the vulnerability does not reside in ASA or FTD software itself.

Hot Fixes Are Available, With No Workaround

Cisco has released six branch-specific Secure FMC hot fixes through Cisco Software Center:

Secure FMC release	Hot-fix file
7.0	Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar
7.2	Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar
7.4	Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar
7.6	Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
7.7	Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar
10.0	Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Customers should match the package to their installed release rather than applying a similarly named file from another branch. Cisco recommends upgrading to the applicable fixed release, treating hot fixes as temporary protection.

The company provides no configuration-based workaround. Restricting management-interface access is a useful exposure-control measure, but it does not correct the vulnerable process.

CISA has reportedly added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and instructed U.S. Federal Civilian Executive Branch agencies to secure affected systems by September 12, 2026. The precise KEV addition date is not known from the available catalog information.

Administrators Should Search Logs Before Declaring Systems Clean

Installing a hot fix can prevent further exploitation, but it may not remove an attacker who already has root access. Cisco therefore supplies an indicator search for execution associated with a temporary license file.

From FMC expert mode, administrators should inspect /var/log/messages* with:

zgrep "package_info.*license" /var/log/messages*

Cisco identifies this pattern as a possible sign of exploitation:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

The critical elements are the web-service account invoking package_info.pl as root and the presence of:

/var/tmp/license.tmp

A matching entry is an indicator, not a complete description of attacker activity. Organizations finding it should preserve relevant logs and contact Cisco Technical Assistance Center immediately for recovery guidance.

Because exploitation provides root privileges, incident responders should not assume that local appliance telemetry is complete or trustworthy. The attacker may have altered files, configuration, accounts, or logging after access. Cisco has not published additional indicators, persistence mechanisms, command-and-control infrastructure, or post-exploitation tools.

The example log entry is dated July 23. That predates Cisco’s statement that PSIRT became aware of active exploitation in August 2026, but it does not prove that CVE-2026-20079 was exploited on July 23. Cisco has not confirmed when the observed attacks began.

A Second Exploited FMC Flaw Shares the Same Indicator

The investigation is complicated by CVE-2026-20316, a separate Secure FMC vulnerability disclosed on July 29. It involves static credentials for a low-privileged account and affects Secure FMC 7.0.9 and earlier.

An unauthenticated attacker can use those credentials to enter the web interface and access sensitive information. The flaw has a CVSS score of 5.3:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Cisco rated CVE-2026-20316 High rather than Critical because the credentials initially provide limited privileges. However, that access could be combined with another FMC weakness to escalate control.

CVE-2026-20316 entered CISA’s KEV catalog on July 29, 2026, with a federal remediation deadline of August 1, 2026. CISA required vendor mitigations, compliance with BOD 26-04 risk-based patching guidance, and its forensic triage requirements.

Cisco had already acknowledged exploitation of CVE-2026-20316. It also associated the same log indicator and identical FMC hot fixes with both vulnerabilities. The shared artifacts suggest possible overlap between the attack activity, but Cisco has not established whether attackers chained the two flaws or used them in the same intrusions.

Cisco’s Recent KEV Exposure Extends Beyond FMC

CVE-2026-20079 is not Cisco’s only recent appearance in the KEV catalog. Four other Cisco vulnerabilities were added during the preceding 90 days: CVE-2026-20349 on August 11, CVE-2008-4128 on July 13, CVE-2026-20230 on June 25, and CVE-2026-20262 on June 15.

For FMC operators, the immediate priorities are narrower: patch or apply the correct hot fix, remove unnecessary internet exposure, search historical logs, and escalate suspected compromises to Cisco TAC.

A clean patch installation is not proof of a clean appliance. Where the indicator appears—or where logging gaps prevent a reliable determination—organizations should handle the FMC system as a potentially root-compromised management asset.