CVE-2026-20079 — Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
Cisco Secure Firewall Management Center is the box that holds the policy, the rules and the credentials for a firewall fleet, and CVE-2026-20079 gives an unauthenticated caller root on it. Cisco describes the flaw as "due to an improper system process that is created at boot time", reachable by sending crafted HTTP requests, and scores it CVSS 3.1 10.0 (CWE-288) against Secure FMC Software and Cisco Security Cloud Control Firewall Management "regardless of device configuration" (Cisco PSIRT, 2026-08-03). What makes this worth acting on now rather than in March is the timeline: the advisory went out on 2026-03-04 with no fix and no workaround, and the per-train hot fixes plus the first compromise-check guidance only arrived with advisory version 2.0 on 2026-07-31, and Cisco has revised that check three times since — v2.1 and v2.2 the same day, v2.3 on 2026-08-03. For roughly five months the only available response was exposure reduction.
The mechanics explain why exposure is narrower than a CVSS 10.0 suggests, and why the detection guidance matters more than usual. VulnCheck built a working exploit and published the chain on 2026-03-26: a startup process leaves a partial csm_processes session in the sfsnort.sessions database, and if nobody authenticates after boot that session persists and can be upgraded using the hardcoded machine-user credential report:snortrules, yielding the sf_action_id request token; an arbitrary file write through the validateLicense bulk AJAX endpoint on sajaxintf.cgi drops a Cisco-format Makeself script to /var/tmp/license.tmp, and calling pjb.cgi with SF::UI::DataObjectLibrary::upgradeReadinessCall makes the appliance process that file as an upgrade package, executing it as root (VulnCheck, 2026-03-26). VulnCheck also found the precondition is fragile — dashboard interaction by a real administrator, cloud-managed session activity, or a periodic cleanup all clear the injected session — so in its assessment the realistic exploitation window is shortly after a reboot, or on appliances nobody logs into. That same source counts roughly 300 internet-facing FMC instances on Censys and between 600 and 700 on FOFA.
Cisco states it is "not aware of any public announcements or malicious use" of this CVE. The reason to treat it as out-of-band anyway sits on the same web interface: the separate static low-privilege credential flaw CVE-2026-20316 is CISA KEV-listed with exploitation Cisco says has been ongoing since July 2026 (covered here on 2026-07-30), and in that advisory Cisco raises the Security Impact Rating to High specifically because "this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-08-03). An attacker already using the exploited flaw for low-privilege read access is one documented step from the root path this CVE opens.
Detection, and the discriminator: both advisories key compromise assessment on the same artifact — a package_info.pl invocation against /var/tmp/license.tmp in /var/log/messages*, run as root via sudo from the www account. Legitimate FMC upgrades and licensing operations do run package_info.pl, so the file path is the signal rather than the command: a genuine upgrade references a package under Cisco's own upgrade directories, not a temporary file in /var/tmp. Because the injected session only survives while no administrator has authenticated, correlate any unauthenticated web-UI activity against appliance boot and uptime records — a request sequence reaching CGI endpoints with no preceding interactive login, minutes after a reboot, is the shape here. Hardening beyond the hot fix is exposure reduction; Cisco notes that "If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced", and low-touch appliances that nobody logs into are precisely the ones that stay exploitable longest.
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
Defender actions
- Install the Cisco Secure FMC hot fix matching your release train (7.0 → GB-7.0.9.1-3, 7.2 → HL-7.2.11.1-4, 7.4 → HG-7.4.7.1-3, 7.6 → CY-7.6.5.1-2, 7.7 → AM-7.7.12.1-2, 10.0 → P-10.0.1.1-2). There is no workaround, and no configuration makes an FMC non-vulnerable.
- Run Cisco's revised compromise check on every FMC that has been network-reachable since 2026-03-04: in expert mode,
zgrep "package_info.*license" /var/log/messages*— a hit naming /var/tmp/license.tmp means the chain reached the package-install step, and Cisco directs those cases to TAC rather than to self-remediation.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Stealth TA0005
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.