Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time.…
  • Highest CVSS: 10.0 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-20079.

What it is

CVE-2026-20079 is an authentication bypass in the web interface of Cisco Secure Firewall Management Center (FMC) Software. It carries a CVSS score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-exploitable, no privileges, no user interaction, and full impact on confidentiality, integrity and availability.

The root cause is an improper system process created at boot time. An unauthenticated, remote attacker can send crafted HTTP requests to the FMC management interface and use this process to execute script files, ultimately gaining root access to the underlying operating system. There is no requirement for valid credentials or prior access — this is a management-plane, network-reachable flaw.

Cisco notes that if the FMC management interface has no public internet access, the attack surface is reduced. The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control (SCC) Firewall Management “regardless of device configuration.” Firewall Device Manager (FDM), Secure Firewall ASA, and Secure Firewall Threat Defense (FTD) are confirmed not affected, as is Security Cloud Control (SCC) itself, distinct from SCC Firewall Management.

Cisco states it is not aware of any public announcements or malicious use of this vulnerability, and it is not listed in CISA’s Known Exploited Vulnerabilities catalogue.

What to do

  • Apply the hot fix for your running FMC release as soon as possible; there are no workarounds. Cisco has published hot fixes for releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 — consult the advisory for the exact hot fix filename matching your version.
  • If you run Cisco SCC Firewall Management, no action is required — Cisco has already deployed the fix to that SaaS environment.
  • Restrict internet exposure of the FMC management interface where possible; this doesn’t remove the flaw but reduces the reachable attack surface until the hot fix is applied.
  • Check for indicators of compromise using the command Cisco provides: in expert mode, run zgrep "package_info.*license" /var/log/messages* and look for references to /var/tmp/license.tmp. If found, treat this as a potential compromise, not just an unpatched device.
  • If indicators of compromise are present, contact Cisco TAC before relying on the hot fix alone — Cisco is explicit that the hot fix prevents future exploitation but may not remediate an existing compromise.
  • Use Cisco’s Software Checker against your specific FMC release to confirm exposure and identify the correct fixed hot fix.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 10.0) across any Cisco kit you run. Follow the remediation in the vendor advisory within 48-72 hours.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source