{"id":"CVE-2026-20079","title":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access …","summary":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access …","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-288"],"vendor":"cisco","product":"secure_firewall_management_center","affected":["secure_firewall_management_center = 7.0.0","secure_firewall_management_center = 7.0.0.1","secure_firewall_management_center = 7.0.1","secure_firewall_management_center = 7.0.1.1","secure_firewall_management_center = 7.0.2","secure_firewall_management_center = 7.0.2.1","secure_firewall_management_center = 7.0.3","secure_firewall_management_center = 7.0.4","secure_firewall_management_center = 7.0.5","secure_firewall_management_center = 7.0.6","secure_firewall_management_center = 7.0.6.1","secure_firewall_management_center = 7.0.6.2","secure_firewall_management_center = 7.0.6.3","secure_firewall_management_center = 7.0.7","secure_firewall_management_center = 7.0.8","secure_firewall_management_center = 7.0.8.1","secure_firewall_management_center = 7.0.9","secure_firewall_management_center = 7.1.0","secure_firewall_management_center = 7.1.0.1","secure_firewall_management_center = 7.1.0.2","secure_firewall_management_center = 7.1.0.3","secure_firewall_management_center = 7.2.0","secure_firewall_management_center = 7.2.0.1","secure_firewall_management_center = 7.2.1","secure_firewall_management_center = 7.2.2","secure_firewall_management_center = 7.2.3","secure_firewall_management_center = 7.2.3.1","secure_firewall_management_center = 7.2.4","secure_firewall_management_center = 7.2.4.1","secure_firewall_management_center = 7.2.5","secure_firewall_management_center = 7.2.5.1","secure_firewall_management_center = 7.2.5.2","secure_firewall_management_center = 7.2.6","secure_firewall_management_center = 7.2.7","secure_firewall_management_center = 7.2.8","secure_firewall_management_center = 7.2.8.1","secure_firewall_management_center = 7.2.9","secure_firewall_management_center = 7.2.10","secure_firewall_management_center = 7.2.10.1","secure_firewall_management_center = 7.2.10.2","secure_firewall_management_center = 7.2.11","secure_firewall_management_center = 7.3.0","secure_firewall_management_center = 7.3.1","secure_firewall_management_center = 7.3.1.1","secure_firewall_management_center = 7.3.1.2","secure_firewall_management_center = 7.4.0","secure_firewall_management_center = 7.4.1","secure_firewall_management_center = 7.4.1.1","secure_firewall_management_center = 7.4.2","secure_firewall_management_center = 7.4.2.1","secure_firewall_management_center = 7.4.2.2","secure_firewall_management_center = 7.4.2.3","secure_firewall_management_center = 7.4.2.4","secure_firewall_management_center = 7.4.3","secure_firewall_management_center = 7.4.4","secure_firewall_management_center = 7.4.5","secure_firewall_management_center = 7.4.6","secure_firewall_management_center = 7.4.7","secure_firewall_management_center = 7.6.0","secure_firewall_management_center = 7.6.1","secure_firewall_management_center = 7.6.2","secure_firewall_management_center = 7.6.2.1","secure_firewall_management_center = 7.6.3","secure_firewall_management_center = 7.6.4","secure_firewall_management_center = 7.6.5","secure_firewall_management_center = 7.7.0","secure_firewall_management_center = 7.7.10","secure_firewall_management_center = 7.7.10.1","secure_firewall_management_center = 7.7.11","secure_firewall_management_center = 7.7.12","secure_firewall_management_center = 10.0.0","secure_firewall_management_center = 10.0.1"],"published":"2026-03-04","updated":"2026-09-16","sourceUpdated":"2026-09-16T17:17:16.340","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20079","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","label":"psirt@cisco.com"},{"url":"http://seclists.org/fulldisclosure/2026/Aug/80","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.talosintelligence.com/fmc-ongoing-exploitation/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://software.cisco.com"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org","csaf","vendor-advisory","cisco"],"epss":0.75752,"epssPercentile":0.99511,"kev":true,"kevDateAdded":"2026-09-09","kevDueDate":"2026-09-12","kevRansomware":false,"exploited":true,"exploits":{"github":3,"githubRepos":["https://github.com/CyberAuth/CVE-2026-20079","https://github.com/0xBlackash/CVE-2026-20079","https://github.com/DiegoArias008/CVE-2026-20079-checker"],"metasploit":["exploit/linux/http/cisco_fmc_auth_bypass_rce"],"nuclei":["CVE-2026-20079"],"checkedAt":"2026-09-21T15:28:22.092Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-10T03:55:16.679381Z"},"ingestedAt":"2026-07-29T17:48:48.974Z","slug":"CVE-2026-20079","body":"## Overview\n\nA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. \n\n## Affected\n\n- `secure_firewall_management_center = 7.0.0`\n- `secure_firewall_management_center = 7.0.0.1`\n- `secure_firewall_management_center = 7.0.1`\n- `secure_firewall_management_center = 7.0.1.1`\n- `secure_firewall_management_center = 7.0.2`\n- `secure_firewall_management_center = 7.0.2.1`\n- `secure_firewall_management_center = 7.0.3`\n- `secure_firewall_management_center = 7.0.4`\n- `secure_firewall_management_center = 7.0.5`\n- `secure_firewall_management_center = 7.0.6`\n- `secure_firewall_management_center = 7.0.6.1`\n- `secure_firewall_management_center = 7.0.6.2`\n- `secure_firewall_management_center = 7.0.6.3`\n- `secure_firewall_management_center = 7.0.7`\n- `secure_firewall_management_center = 7.0.8`\n- `secure_firewall_management_center = 7.0.8.1`\n- `secure_firewall_management_center = 7.0.9`\n- `secure_firewall_management_center = 7.1.0`\n- `secure_firewall_management_center = 7.1.0.1`\n- `secure_firewall_management_center = 7.1.0.2`\n- `secure_firewall_management_center = 7.1.0.3`\n- `secure_firewall_management_center = 7.2.0`\n- `secure_firewall_management_center = 7.2.0.1`\n- `secure_firewall_management_center = 7.2.1`\n- `secure_firewall_management_center = 7.2.2`\n- `secure_firewall_management_center = 7.2.3`\n- `secure_firewall_management_center = 7.2.3.1`\n- `secure_firewall_management_center = 7.2.4`\n- `secure_firewall_management_center = 7.2.4.1`\n- `secure_firewall_management_center = 7.2.5`\n- `secure_firewall_management_center = 7.2.5.1`\n- `secure_firewall_management_center = 7.2.5.2`\n- `secure_firewall_management_center = 7.2.6`\n- `secure_firewall_management_center = 7.2.7`\n- `secure_firewall_management_center = 7.2.8`\n- `secure_firewall_management_center = 7.2.8.1`\n- `secure_firewall_management_center = 7.2.9`\n- `secure_firewall_management_center = 7.2.10`\n- `secure_firewall_management_center = 7.2.10.1`\n- `secure_firewall_management_center = 7.2.10.2`\n- `secure_firewall_management_center = 7.2.11`\n- `secure_firewall_management_center = 7.3.0`\n- `secure_firewall_management_center = 7.3.1`\n- `secure_firewall_management_center = 7.3.1.1`\n- `secure_firewall_management_center = 7.3.1.2`\n- `secure_firewall_management_center = 7.4.0`\n- `secure_firewall_management_center = 7.4.1`\n- `secure_firewall_management_center = 7.4.1.1`\n- `secure_firewall_management_center = 7.4.2`\n- `secure_firewall_management_center = 7.4.2.1`\n- `secure_firewall_management_center = 7.4.2.2`\n- `secure_firewall_management_center = 7.4.2.3`\n- `secure_firewall_management_center = 7.4.2.4`\n- `secure_firewall_management_center = 7.4.3`\n- `secure_firewall_management_center = 7.4.4`\n- `secure_firewall_management_center = 7.4.5`\n- `secure_firewall_management_center = 7.4.6`\n- `secure_firewall_management_center = 7.4.7`\n- `secure_firewall_management_center = 7.6.0`\n- `secure_firewall_management_center = 7.6.1`\n- `secure_firewall_management_center = 7.6.2`\n- `secure_firewall_management_center = 7.6.2.1`\n- `secure_firewall_management_center = 7.6.3`\n- `secure_firewall_management_center = 7.6.4`\n- `secure_firewall_management_center = 7.6.5`\n- `secure_firewall_management_center = 7.7.0`\n- `secure_firewall_management_center = 7.7.10`\n- `secure_firewall_management_center = 7.7.10.1`\n- `secure_firewall_management_center = 7.7.11`\n- `secure_firewall_management_center = 7.7.12`\n- `secure_firewall_management_center = 10.0.0`\n- `secure_firewall_management_center = 10.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **cisco-sa-onprem-fmc-authbypass-5JPp45V2** · Cisco · affected: Cisco Secure Firewall Management Center (FMC) Appliances · updated 2026-09-16 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2)","depth":"hadal","depthScore":95,"depthScoreParts":{"impact":55,"likelihood":15.2,"exploitation":25,"ransomware":0},"changes":[{"seq":201472,"id":"CVE-2026-20079","ts":1789399486915,"field":"exploited","old":"false","new":"true"},{"seq":201471,"id":"CVE-2026-20079","ts":1789399486915,"field":"kev","old":"false","new":"true"},{"seq":201470,"id":"CVE-2026-20079","ts":1789399486915,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":200206,"id":"CVE-2026-20079","ts":1789397013933,"field":"exploited","old":"true","new":"false"},{"seq":200205,"id":"CVE-2026-20079","ts":1789397013933,"field":"kev","old":"true","new":"false"},{"seq":200204,"id":"CVE-2026-20079","ts":1789397013933,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":198130,"id":"CVE-2026-20079","ts":1789391706867,"field":"exploited","old":"false","new":"true"},{"seq":198129,"id":"CVE-2026-20079","ts":1789391706867,"field":"kev","old":"false","new":"true"},{"seq":198128,"id":"CVE-2026-20079","ts":1789391706867,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":195923,"id":"CVE-2026-20079","ts":1789383360522,"field":"exploited","old":"true","new":"false"},{"seq":195922,"id":"CVE-2026-20079","ts":1789383360522,"field":"kev","old":"true","new":"false"},{"seq":195921,"id":"CVE-2026-20079","ts":1789383360522,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":194852,"id":"CVE-2026-20079","ts":1789380286297,"field":"exploited","old":"false","new":"true"},{"seq":194851,"id":"CVE-2026-20079","ts":1789380286297,"field":"kev","old":"false","new":"true"},{"seq":194850,"id":"CVE-2026-20079","ts":1789380286297,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":193639,"id":"CVE-2026-20079","ts":1789378225388,"field":"exploited","old":"true","new":"false"},{"seq":193638,"id":"CVE-2026-20079","ts":1789378225388,"field":"kev","old":"true","new":"false"},{"seq":193637,"id":"CVE-2026-20079","ts":1789378225388,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":192426,"id":"CVE-2026-20079","ts":1789376208128,"field":"exploited","old":"false","new":"true"},{"seq":192425,"id":"CVE-2026-20079","ts":1789376208128,"field":"kev","old":"false","new":"true"},{"seq":192424,"id":"CVE-2026-20079","ts":1789376208128,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":191213,"id":"CVE-2026-20079","ts":1789373085053,"field":"exploited","old":"true","new":"false"},{"seq":191212,"id":"CVE-2026-20079","ts":1789373085053,"field":"kev","old":"true","new":"false"},{"seq":191211,"id":"CVE-2026-20079","ts":1789373085053,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":189998,"id":"CVE-2026-20079","ts":1789369107942,"field":"exploited","old":"false","new":"true"},{"seq":189997,"id":"CVE-2026-20079","ts":1789369107942,"field":"kev","old":"false","new":"true"},{"seq":189996,"id":"CVE-2026-20079","ts":1789369107942,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":188785,"id":"CVE-2026-20079","ts":1789368014094,"field":"exploited","old":"true","new":"false"},{"seq":188784,"id":"CVE-2026-20079","ts":1789368014094,"field":"kev","old":"true","new":"false"},{"seq":188783,"id":"CVE-2026-20079","ts":1789368014094,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":187568,"id":"CVE-2026-20079","ts":1789364979010,"field":"exploited","old":"false","new":"true"},{"seq":187567,"id":"CVE-2026-20079","ts":1789364979010,"field":"kev","old":"false","new":"true"},{"seq":187566,"id":"CVE-2026-20079","ts":1789364979010,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":186355,"id":"CVE-2026-20079","ts":1789362962882,"field":"exploited","old":"true","new":"false"},{"seq":186354,"id":"CVE-2026-20079","ts":1789362962882,"field":"kev","old":"true","new":"false"},{"seq":186353,"id":"CVE-2026-20079","ts":1789362962882,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":185141,"id":"CVE-2026-20079","ts":1789360950951,"field":"exploited","old":"false","new":"true"},{"seq":185140,"id":"CVE-2026-20079","ts":1789360950951,"field":"kev","old":"false","new":"true"},{"seq":185139,"id":"CVE-2026-20079","ts":1789360950951,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":183928,"id":"CVE-2026-20079","ts":1789357889121,"field":"exploited","old":"true","new":"false"},{"seq":183927,"id":"CVE-2026-20079","ts":1789357889121,"field":"kev","old":"true","new":"false"},{"seq":183926,"id":"CVE-2026-20079","ts":1789357889121,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":182180,"id":"CVE-2026-20079","ts":1789354074879,"field":"exploited","old":"false","new":"true"},{"seq":182179,"id":"CVE-2026-20079","ts":1789354074879,"field":"kev","old":"false","new":"true"},{"seq":182178,"id":"CVE-2026-20079","ts":1789354074879,"field":"epss","old":"0.35946","new":"0.75752"},{"seq":180973,"id":"CVE-2026-20079","ts":1789352912322,"field":"exploited","old":"true","new":"false"},{"seq":180972,"id":"CVE-2026-20079","ts":1789352912322,"field":"kev","old":"true","new":"false"},{"seq":180971,"id":"CVE-2026-20079","ts":1789352912322,"field":"epss","old":"0.75752","new":"0.35946"},{"seq":179766,"id":"CVE-2026-20079","ts":1789349973655,"field":"exploited","old":"false","new":"true"},{"seq":179765,"id":"CVE-2026-20079","ts":1789349973655,"field":"kev","old":"false","new":"true"}]}