Active Exploitation Alert: Cisco Secure Firewall Management Center Authentication Bypass (CVE-2026-20079) Added to CISA KEV — Unauthenticated Root on FMC

Executive Summary

CVE-2026-20079 is a critical authentication-bypass vulnerability in Cisco Secure Firewall Management Center (FMC) Software that allows an unauthenticated remote attacker to bypass authentication via crafted HTTP requests to the FMC web interface and execute scripts or commands as root on the underlying operating system. Cisco rates the issue CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CWE-288). There are no workarounds.

Cisco first published the advisory on March 4, 2026. Cisco PSIRT stated it became aware of active exploitation in August 2026; the Exploitation section was updated through advisory revision 2.5/2.6, with the advisory last updated September 16, 2026. CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a federal remediation due date of September 12, 2026, forensic triage required = Yes, and known ransomware campaign use = Unknown. NVD status is Analyzed (lastModified September 16, 2026).

Cisco Security Cloud Control (SCC) Firewall Management (SaaS) was in the vulnerable class, but Cisco states it has already deployed the fix with no customer action required for that SaaS offering. Firewall Device Manager (FDM), Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Security Cloud Control (SCC) formerly Defense Orchestrator are confirmed not vulnerable. As of September 16, 2026, Cisco points remediation to security hardening releases that supersede earlier hot fixes.

Technical Information

Per Cisco, the root cause is an improper system process created at boot time (CWE-288: Authentication Bypass Using an Alternate Path or Channel). An unauthenticated attacker who can reach the FMC web interface can bypass authentication and run commands as root. Cisco notes that if the FMC management interface does not have public internet access, associated attack surface is reduced—but that does not eliminate the vulnerability for reachable management interfaces.

Cisco lists Snort rules 66075–66080 on the advisory. Discovery credit: Brandon Sakai of Cisco (internal security testing). Bug ID: CSCwr96008.

A related concurrent FMC issue, CVE-2026-20316 (static/hard-coded low-privilege credentials), was previously added to CISA KEV (July 29, 2026; due August 1, 2026; known ransomware campaign use: Known) and is often co-discussed in public reporting. Treat it as paired residual risk on the same control plane if static-credential exposure was not also remediated—not as a substitute for CVE-2026-20079 patching.

Cisco Talos (September 9, 2026) documented in-the-wild abuse of CVE-2026-20079 and CVE-2026-20316 across intrusion clusters, describing post-compromise behaviors such as web shells, malicious package execution paths involving package_info.pl / license.tmp, reverse shells, and in some clusters ransomware-adjacent activity. Primary Cisco PSIRT, CISA, and NVD materials do not publish MITRE ATT&CK technique IDs for CVE-2026-20079. This advisory does not invent ATT&CK mappings or APT attribution beyond what those sources state.

Affected Product Versions

Vendor: Cisco. Vulnerable: Cisco Secure FMC Software (regardless of device configuration) and Cisco Security Cloud Control (SCC) Firewall Management (SaaS—Cisco has deployed the fix).

First fixed / hardening releases (Cisco Fixed Software table as of 2026-09-16 — prefer Cisco Software Checker for release-specific mapping):

• 7.0 and earlier → 7.0.10
• 7.2 → 7.2.12
• 7.4 → 7.4.8
• 7.6 → 7.6.6
• 7.7 → 7.7.13
• 10.0 → 10.0.2
• 10.1 → 10.1.0

Prior hot fixes: Cisco previously issued hot fixes; as of the September 16, 2026 update, hardening releases supersede hot fixes for this fix path. Hot fixes prevent future exploitation but may not remediate existing compromise—contact Cisco TAC if IoCs are present.

Confirmed not vulnerable (Cisco): FDM; Secure Firewall ASA Software; Secure Firewall FTD Software; Security Cloud Control (SCC) formerly Defense Orchestrator (distinct from SCC Firewall Management).

Workaround and Mitigation

Cisco states there are no workarounds. Remediation is upgrade to a first-fixed / hardening release.

1. Inventory every on-prem FMC that manages your firewalls—including FMC instances operated by MSSPs, SOCs, or managed-firewall vendors—and record software train/version and whether the management interface is internet-exposed.
2. Upgrade customer-managed FMC to the first-fixed hardening release for your train (table above). Prefer Cisco Software Checker for exact mapping.
3. If you use SCC Firewall Management (SaaS), confirm Cisco’s statement that the fix is already deployed; no customer patch action is required for that offering per Cisco.
4. Because CISA KEV requires forensic triage (Yes) under BOD 26-04 (FCEB due September 12, 2026), do not close residual risk on “version bumped” alone—assess for pre-patch compromise.
5. Run Cisco’s expert-mode IoC check: zgrep "package_info.*license" /var/log/messages* — if output shows /var/tmp/license.tmp (example COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm), exploitation may have occurred; contact Cisco TAC for recovery.
6. Review unauthorized policy pushes, credential changes, and managed-device config deltas during the July–September 2026 window; rotate secrets if compromise is suspected.
7. Treat CVE-2026-20316 as a paired residual risk on the same FMC if static-credential exposure was not also remediated.

Indicators of Compromise

Cisco, CISA, and NVD do not publish a full public IoC package (comprehensive IP/hash C2 list) for CVE-2026-20079 in the PSIRT advisory itself.

Honest empty for official exhaustive IoC packages from Cisco/CISA/NVD: none as a standalone KEV artifact.

Cisco does publish an on-box investigation lead: zgrep "package_info.*license" /var/log/messages* looking for /var/tmp/license.tmp / package_info.pl patterns. Cisco lists Snort 66075–66080; Talos cites additional SIDs and an IOC repository in its public blog—treat as research/vendor leads, and do not download malware samples. Do not invent ATT&CK IDs or additional indicators beyond sourced leads.

References

• Cisco Security Advisory: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2), first published 2026-03-04, last updated 2026-09-16 — https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
• CISA: Adds Four Known Exploited Vulnerabilities to Catalog, 2026-09-09 — https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
• CISA KEV catalog / JSON feed — https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA BOD 26-04 — https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• NVD: CVE-2026-20079 — https://nvd.nist.gov/vuln/detail/CVE-2026-20079
• CVE Record: CVE-2026-20079 — https://www.cve.org/CVERecord?id=CVE-2026-20079
• Cisco Talos: Ongoing exploitation of Cisco Secure FMC vulnerabilities, 2026-09-09 — https://blog.talosintelligence.com/fmc-ongoing-exploitation/
• BleepingComputer: Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks — https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/

Third-Party Risk Bridge: Shared FMC as Firewall Control Plane

FMC is the control plane for enterprise and MSSP-managed firewall fleets. Unauthenticated root on a shared or vendor-managed FMC is not just another firewall bug: it can rewrite policies, disable controls, push malicious configs, harvest credentials for managed devices, and pivot across every customer firewall that trusts that manager. Cisco confirmed exploitation awareness in August 2026; CISA’s KEV listing required forensic triage by September 12, 2026 for FCEB. Ask every MSSP or managed-firewall vendor which FMC manages your estate, which hardening train they are on, whether management was internet-exposed, and whether the Cisco package_info / license.tmp IoC check (and TAC recovery if positive) was completed—not only whether “firewalls are up.”

Book a demo to see how Rescana tracks MSSP and managed-firewall vendors for KEV-class FMC control-plane risk, version attestation, and forensic-triage evidence.

Forward this advisory to your TPRM owner if an MSSP, SOC, or managed-firewall vendor operates an FMC that pushes policy to your firewalls—they own the version, exposure, IoC-check, and unauthorized-change attestation asks above.