CVE-2026-20079 — Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

CISA KEVExploited: confirmedCisco

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

Vulnerability details

Affected productsSecure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
KEV remediation due2026-09-12

Related reporting

Metasploit Wrap Up: This One Goes to Sixteen!rapid7
Cisco FMC CVE-2026-20079 Actively Exploitedsocradar_blog
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomwarethehackernews
We've got one word for it, and it's usually the wrong onetalos
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadlinethehackernews
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacksbleepingcomputer
Cisco security advisory (AV26-197) – Update 3cccs_ca
CISA Adds Four Known Exploited Vulnerabilities to Catalogcisa_advisories
[CISA KEV] CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa_kev
Active exploitation of Cisco Secure Firewall Management Center vulnerabilitiestalos
[NVD] CVE-2026-20079 (CRITICAL 10.0) — A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  nvd
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerabilitycisco_psirt