2026-08-04 · view entry permalink →
CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
Cisco Secure Firewall Management Center is the box that holds the policy, the rules and the credentials for a firewall fleet, and CVE-2026-20079 gives an unauthenticated caller root on it. Cisco describes the flaw as "due to an improper system process that is created at boot time", reachable by sending crafted HTTP requests, and scores it CVSS 3.1 10.0 (CWE-288) against Secure FMC Software and Cisco Security Cloud Control Firewall Management "regardless of device configuration" (Cisco PSIRT, 2026-08-03). What makes this worth acting on now rather than in March is the timeline: the advisory went out on 2026-03-04 with no fix and no workaround, and the per-train hot fixes plus the first compromise-check guidance only arrived with advisory version 2.0 on 2026-07-31, and Cisco has revised that check three times since, v2.1 and v2.2 the same day, v2.3 on 2026-08-03. For roughly five months the only available response was exposure reduction.
The mechanics explain why exposure is narrower than a CVSS 10.0 suggests, and why the detection guidance matters more than usual. VulnCheck built a working exploit and published the chain on 2026-03-26: a startup process leaves a partial csm_processes session in the sfsnort.sessions database, and if nobody authenticates after boot that session persists and can be upgraded using the hardcoded machine-user credential report:snortrules, yielding the sf_action_id request token; an arbitrary file write through the validateLicense bulk AJAX endpoint on sajaxintf.cgi drops a Cisco-format Makeself script to /var/tmp/license.tmp, and calling pjb.cgi with SF::UI::DataObjectLibrary::upgradeReadinessCall makes the appliance process that file as an upgrade package, executing it as root (VulnCheck, 2026-03-26). VulnCheck also found the precondition is fragile (dashboard interaction by a real administrator, cloud-managed session activity, or a periodic cleanup all clear the injected session) so in its assessment the realistic exploitation window is shortly after a reboot, or on appliances nobody logs into. That same source counts roughly 300 internet-facing FMC instances on Censys and between 600 and 700 on FOFA.
Cisco's advisory, as first published on 2026-08-03, said it had seen no public announcements or malicious use of this CVE (Cisco PSIRT, 2026-08-03); CISA's KEV addition on 2026-09-09 (see the update below) now confirms active exploitation Cisco itself had not observed, and Cisco's own advisory has since been revised to say the same thing. The reason to treat it as out-of-band even before that KEV listing sat on the same web interface: the separate static low-privilege credential flaw CVE-2026-20316 is CISA KEV-listed with exploitation Cisco says has been ongoing since July 2026 (covered here on 2026-07-30), and in that advisory Cisco raises the Security Impact Rating to High specifically because "this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-08-03). An attacker already using the exploited flaw for low-privilege read access is one documented step from the root path this CVE opens.
Detection, and the discriminator: both advisories key compromise assessment on the same artifact, a package_info.pl invocation against /var/tmp/license.tmp in /var/log/messages*, run as root via sudo from the www account. Legitimate FMC upgrades and licensing operations do run package_info.pl, so the file path is the signal rather than the command: a genuine upgrade references a package under Cisco's own upgrade directories, not a temporary file in /var/tmp. Because the injected session only survives while no administrator has authenticated, correlate any unauthenticated web-UI activity against appliance boot and uptime records, a request sequence reaching CGI endpoints with no preceding interactive login, minutes after a reboot, is the shape here. Hardening beyond the hot fix is exposure reduction; Cisco notes that "If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced", and low-touch appliances that nobody logs into are precisely the ones that stay exploitable longest.
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This confirms active exploitation that Cisco's own advisory had not reported as of its last revision, and reverses the no-known-malicious-use framing this entry's main analysis carried. The compromise check and hot-fix guidance above are unchanged; any FMC that has been network-reachable since 2026-03-04 and has not yet had the compromise check run should be treated as a priority, not a precaution.
Cisco Talos confirmed active exploitation by three distinct post-compromise clusters (Cisco Talos, 2026-09-09). UAT-12197 exploited this CVE alone, planting a JSP web shell in the CSM Tomcat webroot and a JAR-based command executor used to query the FMC's internal user database for credentials (Cisco Talos, 2026-09-09). UAT-11823 exploited both this CVE and CVE-2026-20316 together; Talos states the cluster "overlaps in tooling with the Sandworm APT actor" (Cisco Talos, 2026-09-09), replacing the appliance's license.tmp file with a malicious root-executed package before deploying a variant of Cyclops Blink, the modular implant the US and UK previously attributed to Sandworm. UAT-11988 entered via CVE-2026-20316's static credential alone and, after AD/MySQL credential harvesting, tunnel-based lateral movement and disabling security tooling, deployed ransomware whose subsequent actions Talos found "were consistent with those of Qilin ransomware affiliates" (Cisco Talos, 2026-09-09). Cisco's own advisory was separately revised (v2.5, 2026-09-09) to confirm it became aware of active exploitation of this vulnerability in August 2026 (Cisco PSIRT, 2026-09-09), and Cisco has scheduled a further comprehensive Secure FMC/ASA/FTD hardening release for 2026-09-16 (Cisco PSIRT advance notification, 2026-09-09).
A JSP file appearing in the CSM Tomcat webroot, or a JAR-based executor querying the FMC's own user database, is UAT-12197's signature; a Cyclops Blink deployment resolves its command-and-control address over DNS-over-HTTPS rather than a hardcoded address, so DoH lookups from the FMC management-plane process are a discriminator; and a SOCKS5 proxy or reverse-SSH tunnel originating from the FMC and forwarding LDAP, LDAPS, Kerberos, SMB or NetBIOS/WinRM traffic toward the internal directory is UAT-11988's lateral-movement signature, worth treating as an active-compromise indicator whether or not ransomware has yet deployed.
Builds on: 2026-07-30/cisco-secure-fmc-cve-2026-20316-static-credential-exploited