CVE entry · CVE-2026-20079
CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
- Actively exploited: added to CISA’s KEV catalog on September 9, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: September 12, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (sec.cloudapps.cisco.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Cisco vulnerabilities
-
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
-
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
-
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
-
Cisco Secure Email Gateway SQL Injection Vulnerability
-
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
-
CVE-2026-20316Used by ransomwareCisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability