Advisory · CVE-2026-20079
Cisco firewall manager bug gives attackers root with no login
An authentication bypass in Cisco Secure Firewall Management Center lets an unauthenticated remote attacker execute scripts as root. Cisco confirms active exploitation by multiple threat clusters, including ransomware and state-sponsored actors.
- Vendor
- Cisco
- Product
- Secure Firewall Management Center
- Identifier / CWE
- CVE-2026-20079
CWE-288 - Action timing
- Sep 30, 2026
Explain it like I’m five
The master key box for every lock in the building leaves a half-cut key in the slot each morning. Anyone who walks up can finish cutting it and open every door, including the room where all the other keys are stored.
- 01Stale boot session
When FMC boots, a startup process creates a partial session entry that persists if no administrator logs in.
- 02Crafted HTTP request
An unauthenticated remote attacker sends crafted HTTP requests to the FMC web interface targeting that session.
- 03Auth bypassed
The stale session is coaxed into behaving like a legitimate authenticated session.
- 04Root achieved
The attacker invokes CGI scripts and executes commands as root on the underlying operating system.
What happened
Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2, first published in March 2026, documents an authentication bypass (CWE-288) in Cisco Secure Firewall Management Center Software. The root cause is an improper system process created at boot time: a partial session persists in the sessions database when no administrator authenticates after boot, and crafted HTTP requests to the FMC web interface can upgrade it into working session permissions, allowing script and command execution as root. Cisco scores it CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Cisco PSIRT confirmed active exploitation in August 2026. On September 9, 2026, Cisco Talos published analysis of three distinct post-compromise clusters: UAT-12197 drops a JSP web shell into the CSM Tomcat webroot plus a JAR command executor and steals user hashes from FMC’s database; UAT-11823 shows tooling overlap with the Russian state-sponsored Sandworm group and deploys a Cyclops Blink implant; UAT-11988 is a Qilin ransomware affiliate that pivots from FMC toward Active Directory. There are no workarounds. Cisco has already fixed its cloud-hosted Security Cloud Control service. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 9, 2026.
What to do
- Apply Cisco’s hotfixes or the superseding security hardening releases to all on-premises FMC instances immediately; a hotfix prevents the next attack but does not clean an already-compromised box.
- Assume compromise for any internet-reachable FMC that was unpatched during the exposure window: isolate, collect volatile evidence, and rebuild rather than patching in place.
- Hunt for the known post-exploitation artifacts: JSP web shells in the CSM Tomcat webroot, malicious JAR files, and use of FMC’s OmniQuery.pl utility to pull authentication data.
- Rotate all credentials stored in or managed through FMC, and review firewall policies pushed by FMC for unauthorized changes, since root on FMC means control of the managed firewall fleet.
Management note
FMC is not one firewall, it is the control plane for the entire firewall fleet, so root access here is a skeleton key to network segmentation itself. Three separate threat clusters, including a ransomware affiliate and a state-sponsored group, were already inside unpatched instances before most teams knew exploitation had started. Patching is urgent, but forensic triage of exposed instances is equally non-negotiable.