CVE-2026-20079
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Key facts
- CVSS score
- 10.0 (v3.1)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
- CWE-288
- EPSS score
- 88.2% (100th percentile)
- In CISA KEV
- Yes, added September 9, 2026
- In EU EUVD
- Yes (EUVD-2026-9438)
- Published
- March 4, 2026
- NVD last modified
- September 16, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Added to the KEV catalog on September 9, 2026; federal remediation due September 12, 2026.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-9438 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on September 16, 2026.
View on the EU Vulnerability DatabaseAffected products
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
- cisco / secure firewall management center
and 22 more…
Certified products that may be affected
1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.
- Cisco Secure Firewall Threat Defense (FTD) 7.4 with Secure Firewall Management Center (FMC) 7.4 and Secure Client 5.1 - Cisco Systems, Inc. - Common Criteria NSCIB-CC-2400046-01-CR - active
References
- http://seclists.org/fulldisclosure/2026/Aug/80(Exploit, Mailing List, Third Party Advisory)
- https://blog.talosintelligence.com/fmc-ongoing-exploitation/(Exploit, Third Party Advisory)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079(US Government Resource)
Last updated September 18, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain