CVE-2026-20079Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access …
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 15.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
39%
Federal remediation due Sep 12, 2026
39% → 76%
Last analysed / modified upstream
3 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Sep 9, 2026. Federal remediation due Sep 12, 2026. View catalog ↗
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
secure_firewall_management_center = 7.0.0secure_firewall_management_center = 7.0.0.1secure_firewall_management_center = 7.0.1secure_firewall_management_center = 7.0.1.1secure_firewall_management_center = 7.0.2secure_firewall_management_center = 7.0.2.1secure_firewall_management_center = 7.0.3secure_firewall_management_center = 7.0.4secure_firewall_management_center = 7.0.5secure_firewall_management_center = 7.0.6secure_firewall_management_center = 7.0.6.1secure_firewall_management_center = 7.0.6.2secure_firewall_management_center = 7.0.6.3secure_firewall_management_center = 7.0.7secure_firewall_management_center = 7.0.8secure_firewall_management_center = 7.0.8.1secure_firewall_management_center = 7.0.9secure_firewall_management_center = 7.1.0secure_firewall_management_center = 7.1.0.1secure_firewall_management_center = 7.1.0.2secure_firewall_management_center = 7.1.0.3secure_firewall_management_center = 7.2.0secure_firewall_management_center = 7.2.0.1secure_firewall_management_center = 7.2.1secure_firewall_management_center = 7.2.2secure_firewall_management_center = 7.2.3secure_firewall_management_center = 7.2.3.1secure_firewall_management_center = 7.2.4secure_firewall_management_center = 7.2.4.1secure_firewall_management_center = 7.2.5secure_firewall_management_center = 7.2.5.1secure_firewall_management_center = 7.2.5.2secure_firewall_management_center = 7.2.6secure_firewall_management_center = 7.2.7secure_firewall_management_center = 7.2.8secure_firewall_management_center = 7.2.8.1secure_firewall_management_center = 7.2.9secure_firewall_management_center = 7.2.10secure_firewall_management_center = 7.2.10.1secure_firewall_management_center = 7.2.10.2secure_firewall_management_center = 7.2.11secure_firewall_management_center = 7.3.0secure_firewall_management_center = 7.3.1secure_firewall_management_center = 7.3.1.1secure_firewall_management_center = 7.3.1.2secure_firewall_management_center = 7.4.0secure_firewall_management_center = 7.4.1secure_firewall_management_center = 7.4.1.1secure_firewall_management_center = 7.4.2secure_firewall_management_center = 7.4.2.1secure_firewall_management_center = 7.4.2.2secure_firewall_management_center = 7.4.2.3secure_firewall_management_center = 7.4.2.4secure_firewall_management_center = 7.4.3secure_firewall_management_center = 7.4.4secure_firewall_management_center = 7.4.5secure_firewall_management_center = 7.4.6secure_firewall_management_center = 7.4.7secure_firewall_management_center = 7.6.0secure_firewall_management_center = 7.6.1secure_firewall_management_center = 7.6.2secure_firewall_management_center = 7.6.2.1secure_firewall_management_center = 7.6.3secure_firewall_management_center = 7.6.4secure_firewall_management_center = 7.6.5secure_firewall_management_center = 7.7.0secure_firewall_management_center = 7.7.10secure_firewall_management_center = 7.7.10.1secure_firewall_management_center = 7.7.11secure_firewall_management_center = 7.7.12secure_firewall_management_center = 10.0.0secure_firewall_management_center = 10.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-20316Medium· 5.3A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within…
CVE-2026-76460Critical· 10.0A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint
CVE-2026-76461Critical· 9.8A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This …
CVE-2026-20284Critical· 9.1A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls
CVE-2026-20306Critical· 9.1A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root
CVE-2026-20305Critical· 9.1A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root