Unauthenticated authentication bypass to root via crafted HTTP requests in Cisco Secure Firewall Management Center (CVE-2026-20079)
CISA added this flaw to KEV on 2026-09-09 with a remediation deadline of 2026-09-12 as Cisco Talos reports ongoing exploitation of FMC and a Metasploit module is public; an unpatched FMC whose management interface is reachable gives an attacker root on the system that manages your firewalls.
An improper system process created at boot time lets a remote attacker with no credentials send crafted HTTP requests to the FMC web interface, bypass authentication, and execute scripts and commands that yield root access to the underlying operating system. Cisco Security Cloud Control (SCC) Firewall Management is affected as well.
Affected: Cisco Secure Firewall Management Center (FMC) 7.0.0; Cisco Secure Firewall Management Center (FMC) 7.0.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1.1; Cisco Secure Firewall Management Center (FMC) 7.0.2; Cisco Secure Firewall Management Center (FMC) 7.0.2.1; Cisco Secure Firewall Management Center (FMC) 7.0.3; Cisco Secure Firewall Management Center (FMC) 7.1.0; Cisco Secure Firewall Management Center (FMC) 7.1.0.1; Cisco Secure Firewall Management Center (FMC) 7.2.0; Cisco Security Cloud Control (SCC) Firewall Management
How to Test
Check the installed FMC software version: releases 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3, 7.1.0, 7.1.0.1 and 7.2.0 are listed as affected, and the Canadian Centre for Cyber Security advisory treats all FMC and SCC Firewall Management versions as in scope, so any release not carrying the fix for Cisco bug IDs CSCwr96008/CSCwt95974 should be considered vulnerable. Determine whether the FMC management web interface is reachable from the internet. Review web interface access logs for unexpected unauthenticated HTTP requests and inspect the appliance for unexpected script or command execution as root, unknown accounts, and unexplained configuration changes; CISA's KEV entry directs organizations to its Forensics Triage Requirements for compromised devices.
How to Patch
Upgrade FMC to a release containing the fix tracked under Cisco bug IDs CSCwr96008 and CSCwt95974 in advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2; Cisco states there are no workarounds. Until the upgrade is applied, remove public internet access from the FMC management interface, which Cisco notes reduces the attack surface.