Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20079 10.0
Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management · Added 2026-09-09 · Published 2026-03-04
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
VendorCisco
ProductSecure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Date added2026-09-09
Due date2026-09-12
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-288
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions

KEV: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

NVD: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-09-09 21:10 UTC
Searches5
Component defaultyes
Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20079/
https://blog.talosintelligence.com/fmc-ongoing-exploitation/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml
https://github.com/advisories/GHSA-mv8w-c2qv-cgrg
https://www.sentinelone.com/vulnerability-database/cve-2026-20079/
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/get-started-overview.html

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt FMC web access logs for GET /help/about.cgi with Cookie: CGISESSID=csm_processes returning 200 without prior session; monitor syslog for 'package_info.pl /var/tmp/license.tmp' and IDS for Snort SIDs 66075-66080.

Research details

ComponentFMC web interface /help/about.cgi endpoint (Tomcat-based CSM web application)
PreconditionsNetwork-reachable FMC management web interface (port 443); no authentication or user interaction required; affects Cisco Secure FMC Software versions 7.0.0 through 7.0.9, 7.1.0 through 7.1.0.3, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12, and 10.0.0 through 10.0.1; Cisco SCC Firewall Management is SaaS-delivered and patched by Cisco. agent
DeliveryCrafted HTTP GET request to /help/about.cgi with hardcoded Cookie: CGISESSID=csm_processes
Public PoCyes
PoC URLs https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml Third-party repos; verify before use.
Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
Exploit notesNuclei template (detection/verification) uses GET /help/about.cgi with Cookie: CGISESSID=csm_processes to bypass auth and read the FMC model/hostname page. Active exploitation documented by Cisco Talos (September 2026) across three threat clusters: UAT-12197 deploys JSP web shells (home.jsp with parameter F6C1F0E7, Base64-encoded class loader) and JAR command executors; UAT-11823 (Sandworm overlap) deploys Netcat reverse shells via /var/tmp/license.tmp processed by package_info.pl, then Cyclops Blink modular ELF implant; UAT-11988 (Qilin ransomware) uses static credentials (CVE-2026-20316) and abuses package_info.pl for LOTL execution. Snort SIDs 66075-66080 cover CVE-2026-20079. IOCs published at github.com/Cisco-Talos/IOCs/tree/main/2026/09.
SummaryCritical authentication bypass (CVSS 10.0) in the Cisco Secure Firewall Management Center web interface due to an improper boot-time system process, allowing unauthenticated remote root access via crafted HTTP requests to /help/about.cgi. Actively exploited by state-sponsored and crimeware actors as documented by Cisco Talos; hotfixes available for all affected FMC release branches with no workarounds.

Tia coverage

First reported2026-07-29
First exploit report2026-08-06
Exploit report → KEV34 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-vchipmaker-patch-tuesday-nvidia-amd-arm-issue-security-advisoriescisa-kev-update-september-9-2026cisco-patches-firewall-zero-day-exploited-for-dos-attackscisco-ships-two-dozen-fixes-cvss-10-0-fmc-auth-bypass-9-9-sd-wanproofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub