CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
Cisco's CVSS 10.0 Secure FMC authentication bypass finally has hot fixes, and a compromise check Cisco revised three times in four days
Defender actions
- Install the Cisco Secure FMC hot fix matching your release train (7.0 → GB-7.0.9.1-3, 7.2 → HL-7.2.11.1-4, 7.4 → HG-7.4.7.1-3, 7.6 → CY-7.6.5.1-2, 7.7 → AM-7.7.12.1-2, 10.0 → P-10.0.1.1-2). There is no workaround, and no configuration makes an FMC non-vulnerable.
- Run Cisco's revised compromise check on every FMC that has been network-reachable since 2026-03-04: in expert mode,
zgrep "package_info.*license" /var/log/messages*, a hit naming /var/tmp/license.tmp means the chain reached the package-install step, and Cisco directs those cases to TAC rather than to self-remediation.
Analysis
Cisco Secure Firewall Management Center is the box that holds the policy, the rules and the credentials for a firewall fleet, and CVE-2026-20079 gives an unauthenticated caller root on it. Cisco describes the flaw as "due to an improper system process that is created at boot time", reachable by sending crafted HTTP requests, and scores it CVSS 3.1 10.0 (CWE-288) against Secure FMC Software and Cisco Security Cloud Control Firewall Management "regardless of device configuration" (Cisco PSIRT, 2026-08-03). What makes this worth acting on now rather than in March is the timeline: the advisory went out on 2026-03-04 with no fix and no workaround, and the per-train hot fixes plus the first compromise-check guidance only arrived with advisory version 2.0 on 2026-07-31, and Cisco has revised that check three times since, v2.1 and v2.2 the same day, v2.3 on 2026-08-03. For roughly five months the only available response was exposure reduction.
The mechanics explain why exposure is narrower than a CVSS 10.0 suggests, and why the detection guidance matters more than usual. VulnCheck built a working exploit and published the chain on 2026-03-26: a startup process leaves a partial csm_processes session in the sfsnort.sessions database, and if nobody authenticates after boot that session persists and can be upgraded using the hardcoded machine-user credential report:snortrules, yielding the sf_action_id request token; an arbitrary file write through the validateLicense bulk AJAX endpoint on sajaxintf.cgi drops a Cisco-format Makeself script to /var/tmp/license.tmp, and calling pjb.cgi with SF::UI::DataObjectLibrary::upgradeReadinessCall makes the appliance process that file as an upgrade package, executing it as root (VulnCheck, 2026-03-26). VulnCheck also found the precondition is fragile (dashboard interaction by a real administrator, cloud-managed session activity, or a periodic cleanup all clear the injected session) so in its assessment the realistic exploitation window is shortly after a reboot, or on appliances nobody logs into. That same source counts roughly 300 internet-facing FMC instances on Censys and between 600 and 700 on FOFA.
Cisco's advisory, as first published on 2026-08-03, said it had seen no public announcements or malicious use of this CVE (Cisco PSIRT, 2026-08-03); CISA's KEV addition on 2026-09-09 (see the update below) now confirms active exploitation Cisco itself had not observed, and Cisco's own advisory has since been revised to say the same thing. The reason to treat it as out-of-band even before that KEV listing sat on the same web interface: the separate static low-privilege credential flaw CVE-2026-20316 is CISA KEV-listed with exploitation Cisco says has been ongoing since July 2026 (covered here on 2026-07-30), and in that advisory Cisco raises the Security Impact Rating to High specifically because "this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-08-03). An attacker already using the exploited flaw for low-privilege read access is one documented step from the root path this CVE opens.
Detection, and the discriminator: both advisories key compromise assessment on the same artifact, a package_info.pl invocation against /var/tmp/license.tmp in /var/log/messages*, run as root via sudo from the www account. Legitimate FMC upgrades and licensing operations do run package_info.pl, so the file path is the signal rather than the command: a genuine upgrade references a package under Cisco's own upgrade directories, not a temporary file in /var/tmp. Because the injected session only survives while no administrator has authenticated, correlate any unauthenticated web-UI activity against appliance boot and uptime records, a request sequence reaching CGI endpoints with no preceding interactive login, minutes after a reboot, is the shape here. Hardening beyond the hot fix is exposure reduction; Cisco notes that "If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced", and low-touch appliances that nobody logs into are precisely the ones that stay exploitable longest.
Cited evidence
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
A registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device.
A successful exploit could allow the attacker to write a file to the device that is executed with root privileges. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Updates3
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, with a remediation due date of 2026-09-12 for federal civilian agencies. This confirms active exploitation that Cisco's own advisory had not reported as of its last revision, and reverses the no-known-malicious-use framing this entry's main analysis carried. The compromise check and hot-fix guidance above are unchanged; any FMC that has been network-reachable since 2026-03-04 and has not yet had the compromise check run should be treated as a priority, not a precaution.
Cisco Talos confirmed active exploitation by three distinct post-compromise clusters (Cisco Talos, 2026-09-09). UAT-12197 exploited this CVE alone, planting a JSP web shell in the CSM Tomcat webroot and a JAR-based command executor used to query the FMC's internal user database for credentials (Cisco Talos, 2026-09-09). UAT-11823 exploited both this CVE and CVE-2026-20316 together; Talos states the cluster "overlaps in tooling with the Sandworm APT actor" (Cisco Talos, 2026-09-09), replacing the appliance's license.tmp file with a malicious root-executed package before deploying a variant of Cyclops Blink, the modular implant the US and UK previously attributed to Sandworm. UAT-11988 entered via CVE-2026-20316's static credential alone and, after AD/MySQL credential harvesting, tunnel-based lateral movement and disabling security tooling, deployed ransomware whose subsequent actions Talos found "were consistent with those of Qilin ransomware affiliates" (Cisco Talos, 2026-09-09). Cisco's own advisory was separately revised (v2.5, 2026-09-09) to confirm it became aware of active exploitation of this vulnerability in August 2026 (Cisco PSIRT, 2026-09-09), and Cisco has scheduled a further comprehensive Secure FMC/ASA/FTD hardening release for 2026-09-16 (Cisco PSIRT advance notification, 2026-09-09).
A JSP file appearing in the CSM Tomcat webroot, or a JAR-based executor querying the FMC's own user database, is UAT-12197's signature; a Cyclops Blink deployment resolves its command-and-control address over DNS-over-HTTPS rather than a hardcoded address, so DoH lookups from the FMC management-plane process are a discriminator; and a SOCKS5 proxy or reverse-SSH tunnel originating from the FMC and forwarding LDAP, LDAPS, Kerberos, SMB or NetBIOS/WinRM traffic toward the internal directory is UAT-11988's lateral-movement signature, worth treating as an active-compromise indicator whether or not ransomware has yet deployed.
Cisco's promised 2026-09-16 hardening release shipped on schedule, adding two more critical, unauthenticated-adjacent root-RCE flaws to the same Secure FMC product line: CVE-2026-20324 (CVSS 9.9), a flaw in the sftunnel inter-device communication protocol where a registered peer has incorrect file-write permissions, letting an attacker who already holds valid low-privilege device credentials write an arbitrary file that executes as root (Cisco PSIRT, 2026-09-16); and CVE-2026-20242 (CVSS 9.8), an insecure Java deserialization bug in the FMC External Database Access feature reachable by a host already present in that feature's allowlist, needing no credentials of its own (Cisco PSIRT, 2026-09-16). Cisco confirms ASA and FTD Software are not affected by either flaw; there is no workaround for CVE-2026-20324, while CVE-2026-20242 can be mitigated by disabling External Database Access entirely until patched. Cisco states it is not aware of any public announcements or malicious use of either flaw.
Sources8
Revision history
- Published 2026-08-04T0411Z-intel
- Update 2026-09-10T0410Z-intel
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 2026-09-09, confirming active exploitation Cisco itself had not previously reported ("not aware of any public announcements or malicious use"). Status moves from patch-available-only to confirmed exploited; the hot fixes and compromise check this entry already describes are unchanged, but the compromise check is now the do-now priority rather than a precaution.
Changed: cves tags summary body
- Update 2026-09-13T0409Z-intel
Cisco Talos named three distinct post-compromise clusters exploiting this CVE and its sibling CVE-2026-20316: one deploying a web shell for credential theft, one assessed to overlap in tooling with Sandworm and deploying a Cyclops Blink variant, and one deploying Qilin-affiliate ransomware. Cisco's own advisory was separately revised to confirm it became aware of active exploitation in August 2026, and Cisco has scheduled a further hardening release for 2026-09-16.
Changed: entities techniques tags evidence sources body
- Update 2026-09-18T0410Z-intel
Cisco's promised 2026-09-16 hardening release shipped on schedule, adding two more critical, unauthenticated-adjacent root-RCE flaws to the same Secure FMC product line: CVE-2026-20324 (sftunnel arbitrary file write, requires existing low-priv credentials) and CVE-2026-20242 (Java deserialization via the External Database Access allowlist, no credentials of its own needed). Neither is reported exploited; ASA and FTD are confirmed not affected by either.
Changed: cves sources evidence body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.