Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
  • Highest CVSS: 10.0 (Critical).
  • Listed in CISA KEV (2026-09-09) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-20079.

What it is

CVE-2026-20079 is an authentication bypass in the web interface of Cisco Secure Firewall Management Center (FMC) Software, also affecting Cisco Security Cloud Control (SCC) Firewall Management. It carries a CVSS score of 10.0 and is listed in the CISA KEV catalogue, added 9 September 2026.

The root cause is an improper system process created at boot time. An unauthenticated, remote attacker can send crafted HTTP requests to the affected device’s web interface, bypass authentication entirely, and execute script files on the underlying host. This gives root access to the operating system beneath FMC — not just the management application.

This sits on the management plane: FMC is the console used to configure and monitor Cisco Secure Firewall deployments, so root compromise of an FMC instance has implications beyond the box itself, potentially extending to the policies and firewalls it manages. No authentication, prior access, or user interaction is required (PR:N, UI:N), and the attack is network-based (AV:N) with low complexity (AC:L).

What to do

  • Cisco has not published fixed version numbers in the material reviewed here; consult the Cisco advisory directly for the release that addresses CVE-2026-20079 and apply it as a priority given the KEV listing.
  • Restrict network access to the FMC web interface — it should not be reachable from the internet or from general user network segments. Limit access to a dedicated management network or VPN.
  • Check Cisco’s guidance for any interim mitigations or indicators of compromise associated with this vulnerability, since the advisory describes a specific boot-time process flaw rather than a generic web bug.
  • If FMC is internet-facing or has been exposed to untrusted networks, treat it as potentially compromised until you have confirmed patch status and reviewed logs for anomalous HTTP requests to the management interface.
  • Track Cisco Security Cloud Control (SCC) Firewall Management separately, as it is named alongside FMC as affected — confirm its patch status independently.

For leadership 🧭

Executive summary. Cisco’s Firewall Management Center console, which controls firewall policy across an estate, can be fully taken over by a remote attacker with no credentials, and the flaw is already listed as actively exploited by CISA. Given the maximum severity score and management-plane reach, this needs emergency attention now, not at the next scheduled patch cycle.

Why it matters:

  • FMC is the central console for configuring and monitoring Cisco Secure Firewall deployments, so root access to it potentially exposes the policies and firewalls it manages, not just the box itself.
  • The flaw stems from an improper system process created at boot, meaning it’s baked into how the device starts up rather than a simple web application bug — interim mitigations may be limited.
  • No authentication, prior access, or user interaction is required, and the attack travels over the network, so any internet-reachable or general-network-reachable FMC web interface is exposed to remote root compromise.
  • Cisco Security Cloud Control (SCC) Firewall Management is named as separately affected, so an organisation using both FMC and SCC has two attack surfaces to track.

Now / Next / Later:

  • Now: Identify every FMC and SCC Firewall Management instance and immediately restrict web interface access to a dedicated management network or VPN, removing any internet or general-user-segment reachability.
  • Next: Apply the Cisco-released fix for CVE-2026-20079 to FMC and confirm SCC Firewall Management’s patch status independently during your next available change window, given this is already in CISA’s KEV catalogue.
  • Later: Review logs on any previously internet-facing or exposed FMC instance for anomalous HTTP requests to the management interface, and establish standing network segmentation that keeps FMC and SCC management interfaces off general-access networks by default.

Source