Cloudanix VulnDB

CVE-2026-20079

Critical · 10.0 CISA KEV

CVSS

10.0

EPSS

88.5%

Published

Mar 4, 2026

CISA due date

Sep 12, 2026

Cloudanix analysis

Act now SSVC: Attend

A flaw in Cisco firewall management software lets remote attackers break in without a password and take complete control of the device, potentially exposing entire networks.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Full Compromise
Component
Application
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper boot-time system process in the web interface allows unauthenticated remote attackers to send crafted HTTP requests that bypass authentication and execute arbitrary scripts/commands, resulting in root access to the underlying OS.

Why it matters to the business

Full compromise of firewall management infrastructure enables attackers to disable security controls, exfiltrate data, or pivot into protected networks; high urgency due to CISA KEV listing with 2026-09-12 remediation deadline and rapidly rising EPSS indicating active exploitation in the wild.

How an attack unfolds

Attacker identifies exposed Cisco FMC web interface and sends specially crafted HTTP requests that abuse the improper boot-time process to bypass authentication, then executes scripts to escalate to root privileges on the device; observed active in the wild.

How to fix it

Apply the latest patched version of Cisco Secure Firewall Management Center Software from Cisco as soon as available; restrict web interface access via firewall rules or VPN until patched; monitor Cisco advisories for exact fixed releases.

How to confirm the fix worked

Confirm device version matches a patched release; test that unauthenticated HTTP requests no longer permit script execution or root access; review boot process integrity and authentication logs post-upgrade.

Typical attack path

  1. Identify publicly reachable Cisco FMC web interface
  2. Send crafted HTTP requests exploiting the boot-time process flaw
  3. Bypass authentication controls
  4. Execute scripts and commands to obtain root OS access
  5. Establish persistence or perform further actions on the device

How to detect it

Review web server and authentication logs for unusual unauthenticated HTTP requests to the FMC interface; inspect boot logs and process creation events for unexpected script executions; correlate with root-level command activity without prior authentication.

  • crafted HTTP requests to FMC web interface bypassing auth
  • unexpected script execution at boot time
  • root shell access without authentication logs

What your security team should do

  • Prioritize patching to meet CISA KEV deadline of 2026-09-12
  • Temporarily restrict network access to the FMC web interface to trusted sources only
  • Enable enhanced logging for HTTP requests and boot-time processes
  • Monitor EPSS and threat intelligence feeds for continued exploitation activity

The record

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities