CVE-2026-20079: Cisco Secure FMC Authentication Bypass to Root RCE

CVE-2026-20079 is an authentication-bypass flaw in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control Firewall Management that lets a remote, unauthenticated attacker run scripts and commands as root on the appliance, and Cisco PSIRT confirmed active exploitation of it in the wild starting in August 2026.

CVE-2026-20079 is an authentication bypass using an alternate path or channel (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, also affecting the SaaS-delivered Cisco Security Cloud Control (SCC) Firewall Management. Cisco's advisory states the flaw "is due to an improper system process that is created at boot time," and that "an attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device," with a successful exploit allowing "the attacker to execute a variety of scripts and commands that allow root access to the device" (Cisco Security Advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2).

NVD's record for this CVE is Analyzed and includes the full set of vulnerable FMC release builds, but NVD has not published its own independent Primary CVSS score; the only metric on record is the reporting Cisco PSIRT's Secondary rating of CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). So the 10.0 shown here is Cisco's own CNA Secondary score, not an NVD-confirmed Primary score (NVD).

Cisco's advisory states plainly: "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," and "there are no workarounds that address this vulnerability" — only upgrading remediates it. Cisco confirms Firewall Device Manager (FDM), ASA Software and FTD Software are not affected, and that fixes have already been auto-deployed to SaaS SCC environments with no customer action required (Cisco Security Advisory).

CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-09, with a required-action due date of 2026-09-12; the catalog does not record known ransomware campaign use for this CVE (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.8847 (99.770th percentile), consistent with Cisco's own account of ongoing in-the-wild attacks against on-premises FMC deployments (FIRST EPSS).

Any on-premises FMC deployment on an affected build, especially one reachable from the public internet, should be upgraded to the fixed release for its branch immediately; Cisco notes that reducing the FMC management interface's internet exposure reduces the attack surface but does not remove the vulnerability.

• Authentication bypass in the FMC web interface, caused by an improper system process created at boot time, lets an unauthenticated remote attacker send crafted HTTP requests to execute scripts/commands and obtain root access. — Cisco Security Advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2
• CVSS v3.1 base score is 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the reporting Cisco PSIRT's Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Cisco PSIRT became aware of active exploitation in August 2026; no workarounds exist; FDM/ASA/FTD Software are confirmed not affected; fixed releases are 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13 and 10.0.2 per branch. — Cisco Security Advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-09, required-action due date 2026-09-12. — CISA KEV
• EPSS score is 0.8847 (99.770th percentile) as of 2026-10-28. — FIRST EPSS