Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time.…
  • Highest CVSS: 10.0 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-20079.

What it is

CVE-2026-20079 is an authentication bypass in the web interface of Cisco Secure Firewall Management Center (FMC) Software. It carries a CVSS score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-exploitable, no privileges, no user interaction, and full impact on confidentiality, integrity and availability.

The root cause is an improper system process created at boot time. An unauthenticated, remote attacker can send crafted HTTP requests to the FMC management interface and use this process to execute script files, ultimately gaining root access to the underlying operating system. There is no requirement for valid credentials or prior access — this is a management-plane, network-reachable flaw.

Cisco notes that if the FMC management interface has no public internet access, the attack surface is reduced. The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control (SCC) Firewall Management “regardless of device configuration.” Firewall Device Manager (FDM), Secure Firewall ASA, and Secure Firewall Threat Defense (FTD) are confirmed not affected, as is Security Cloud Control (SCC) itself, distinct from SCC Firewall Management.

Cisco states it is not aware of any public announcements or malicious use of this vulnerability, and it is not listed in CISA’s Known Exploited Vulnerabilities catalogue.

What to do

  • Apply the hot fix for your running FMC release as soon as possible; there are no workarounds. Cisco has published hot fixes for releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 — consult the advisory for the exact hot fix filename matching your version.
  • If you run Cisco SCC Firewall Management, no action is required — Cisco has already deployed the fix to that SaaS environment.
  • Restrict internet exposure of the FMC management interface where possible; this doesn’t remove the flaw but reduces the reachable attack surface until the hot fix is applied.
  • Check for indicators of compromise using the command Cisco provides: in expert mode, run zgrep "package_info.*license" /var/log/messages* and look for references to /var/tmp/license.tmp. If found, treat this as a potential compromise, not just an unpatched device.
  • If indicators of compromise are present, contact Cisco TAC before relying on the hot fix alone — Cisco is explicit that the hot fix prevents future exploitation but may not remediate an existing compromise.
  • Use Cisco’s Software Checker against your specific FMC release to confirm exposure and identify the correct fixed hot fix.

For leadership 🧭

Executive summary. Cisco’s Secure Firewall Management Center, the console that controls firewall policy across an estate, can be fully compromised by anyone who can reach its web interface, without a password. Given the maximum severity score and the fact that FMC governs firewall configuration, this needs emergency patching now, not at the next scheduled window.

Why it matters:

Now / Next / Later:

  • Now: placeholder
  • Next: placeholder
  • Later: placeholder

Source