CVE-2026-20079

What is Cisco Secure Firewall Management Center?

Cisco Secure Firewall Management Center (FMC, formerly Firepower Management Center) is the central console that administrators use to configure, monitor, and push policy to fleets of Cisco Secure Firewall Threat Defense (FTD) appliances. Cisco Security Cloud Control (SCC) Firewall Management is the on-premises variant of the same management plane. Because a single FMC controls the rule base, logging, and software updates for potentially hundreds of firewalls, root access to it is a fleet-wide compromise: an attacker can weaken or disable inspection, open pinholes, and read every connection log the firewalls forward. The management interface is supposed to sit on an isolated network, but scans in September 2026 still found several hundred FMC web interfaces reachable from the internet.

Overview

CVE-2026-20079 is an unauthenticated authentication bypass (CWE-288) in the FMC web management interface, rated CVSS 10.0. A remote attacker who can reach the interface can bypass login and execute script files on the appliance as root. Cisco published the fix on 2026-03-04 after internal testing found the bug. Five months later Cisco PSIRT confirmed active exploitation, and CISA added it to the KEV catalog on 2026-09-09 with a three-day remediation deadline.

Affected Versions

Cisco Secure Firewall Threat Defense (FTD), ASA, and cloud-delivered Firewall Management Center are not affected. There are no workarounds.

Technical Details

The root cause is an improperly configured boot-time process. When FMC starts, a startup routine creates a partial csm_processes session record in the sfsnort.sessions database. If no legitimate administrator logs in after boot, that orphaned session persists indefinitely. A remote attacker can send crafted HTTP requests to the web interface that adopt and upgrade the orphaned session into a fully privileged one, then use the resulting access to run script files as root on the underlying Linux OS.

Attack characteristics:

• Authentication: none required
• Complexity: low; a handful of HTTP requests
• Vector: network, to the management web interface (TCP 443)
• Impact: root command execution with scope change (CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Because the flaw is a logic error in session handling rather than memory corruption, exploitation is deterministic and does not depend on the target's memory layout.

Discovery

The vulnerability was found by Brandon Sakai of Cisco during internal security testing and disclosed with fixed releases in the 2026-03-04 advisory. There was no public exploitation known at that time.

Exploitation Context

Cisco PSIRT became aware of attempted exploitation in August 2026 and updated the advisory to confirm it. Log-based indicators shared by Cisco suggest activity as early as 2026-07-23. Cisco described three distinct clusters of post-compromise activity, all deploying web shells or additional malware to the appliance.

Press reporting has associated the exploitation with a Russian state-linked actor and separately with a ransomware affiliate. Cisco itself has not attributed the activity, so treat that attribution as press reporting rather than vendor confirmation. Internet scans by Censys and FOFA in September 2026 put the number of exposed FMC web interfaces at roughly 300 to 700.

Key indicator from Cisco: entries in /var/log/messages showing package_info.pl /var/tmp/license.tmp --lsm executed via sudo by the www user, with PWD=/ and USER=root.

Remediation

1. Upgrade every FMC and SCC Firewall Management appliance to the first fixed release for its train (see table). There is no workaround; if you cannot upgrade, remove the management interface from any network an attacker could reach.
2. Hunt for compromise before assuming the upgrade is enough. Review /var/log/messages for references to /var/tmp/license.tmp and for any sudo invocations by the www user. Check the web root and /var/tmp for unexpected scripts or web shells.
3. Restrict management access. FMC should only be reachable from a dedicated management VLAN or jump host. Verify firewall and ACL rules that front the management interface.
4. Rotate credentials and certificates stored on or used by the FMC, including FTD registration keys, LDAP/AD bind accounts, and API tokens, if any indicator is found.
5. Review pushed policy. Compare current access-control and NAT policy against your change records; an attacker with root on FMC can silently modify what the managed firewalls enforce.
6. Follow BOD 26-04 triage guidance if you are a US federal agency: the KEV entry requires forensic triage before remediation.