CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-20079
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20079Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20079 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploited[UPDATE] [kritisch] Cisco Secure Firewall Management Center: Mehrere Schwachstellencert-bund
- criticalexploitedCisco security advisory (AV26-197) – Update 3cccs
- criticalexploitedCisco Secure Firewall Management Center Software Authentication Bypass Vulnerabilitycisco-psirt
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
Recent advisories for Cisco Firewall Management
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploited[UPDATE] [kritisch] Cisco Secure Firewall Management Center: Mehrere Schwachstellencert-bund · 2026-09-10
- criticalexploitedCisco Secure Firewall Management Center Software Authentication Bypass Vulnerabilitycisco-psirt · 2026-09-09
- highexploitedCisco Secure Firewall Management Center Software Static Credential Vulnerabilitycisco-psirt · 2026-08-11
- medium[NEW] [medium] Cisco Secure Firewall Management Center: Vulnerability allows information disclosurecert-bund · 2026-07-30
- unknownexploitedNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Centerncsc-nl · 2026-07-30
- unknownexploitedCisco Secure Firewall Management Center Software Information Disclosure Vulnerabilityhkcert · 2026-07-30
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability2026-09-09
- criticalCVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability2026-09-09
- criticalCVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability2026-09-09
- criticalCVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engi…2026-09-08
- criticalCVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability2026-09-08