--- id: "CVE-2026-20079" kind: "vulnerability" aliases: ["CVE-2026-20079"] title: "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an\u2026" severity: "critical" cvss: 10.0 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Cisco Secure Firewall Management Center (FMC)", "fixed": ["7.0.10", "7.2.12", "7.4.8", "7.6.6", "7.7.13", "10.0.2", "10.1.0"], "affected": "all releases below the first fixed release per train (<= 7.0.9, 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2)", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.0.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.1.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.2.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.3", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.4", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.5", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.6", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.6.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.6.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.6.3", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.7", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.8", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.8.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.0.9", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.1.0", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.1.0.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.1.0.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.1.0.3", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.0", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.0.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.3", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.3.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.4", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.4.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.5", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.5.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.5.2", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.6", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.7", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.8", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.8.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.9", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.10", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.10.1", "ecosystem": "vendor"}, {"name": "cisco secure firewall management center", "fixed": [], "affected": "= 7.2.10.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cisco", "cloudflare", "exploited", "firewall-management", "fmc", "lab-disclosure", "rce", "self-hosted", "unauthenticated", "vendor"] not_affected_if: ["fixed-version", "managed-hosting", "saas-scc"] published_at: "2026-03-04T18:16:24+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T19:12:57+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:29:00+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20079", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}] --- # A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an… Unauthenticated remote attacker sends crafted HTTP requests to the FMC web interface, bypasses authentication and runs scripts as root (CWE-288, CVSS 10.0). It affects all on-prem FMC releases regardless of configuration. Cisco says it is actively exploited (since Aug 2026). There are no workarounds. Cisco SCC Firewall Management is SaaS and Cisco has already patched it. FTD, ASA, FDM and SCC are not affected. Reducing public exposure of the management interface reduces the attack surface but does not fix it. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management affected ? fixed ? - vendor:Cisco Secure Firewall Management Center (FMC) affected all releases below the first fixed release per train (<= 7.0.9, 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2) fixed 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0 - vendor:cisco secure firewall management center affected = 7.0.0 fixed ? - vendor:cisco secure firewall management center affected = 7.0.0.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.1.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.2 fixed ? - vendor:cisco secure firewall management center affected = 7.0.2.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.3 fixed ? - vendor:cisco secure firewall management center affected = 7.0.4 fixed ? - vendor:cisco secure firewall management center affected = 7.0.5 fixed ? - vendor:cisco secure firewall management center affected = 7.0.6 fixed ? - vendor:cisco secure firewall management center affected = 7.0.6.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.6.2 fixed ? - vendor:cisco secure firewall management center affected = 7.0.6.3 fixed ? - vendor:cisco secure firewall management center affected = 7.0.7 fixed ? - vendor:cisco secure firewall management center affected = 7.0.8 fixed ? - vendor:cisco secure firewall management center affected = 7.0.8.1 fixed ? - vendor:cisco secure firewall management center affected = 7.0.9 fixed ? - vendor:cisco secure firewall management center affected = 7.1.0 fixed ? - vendor:cisco secure firewall management center affected = 7.1.0.1 fixed ? - vendor:cisco secure firewall management center affected = 7.1.0.2 fixed ? - vendor:cisco secure firewall management center affected = 7.1.0.3 fixed ? - vendor:cisco secure firewall management center affected = 7.2.0 fixed ? - vendor:cisco secure firewall management center affected = 7.2.0.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.2 fixed ? - vendor:cisco secure firewall management center affected = 7.2.3 fixed ? - vendor:cisco secure firewall management center affected = 7.2.3.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.4 fixed ? - vendor:cisco secure firewall management center affected = 7.2.4.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.5 fixed ? - vendor:cisco secure firewall management center affected = 7.2.5.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.5.2 fixed ? - vendor:cisco secure firewall management center affected = 7.2.6 fixed ? - vendor:cisco secure firewall management center affected = 7.2.7 fixed ? - vendor:cisco secure firewall management center affected = 7.2.8 fixed ? - vendor:cisco secure firewall management center affected = 7.2.8.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.9 fixed ? - vendor:cisco secure firewall management center affected = 7.2.10 fixed ? - vendor:cisco secure firewall management center affected = 7.2.10.1 fixed ? - vendor:cisco secure firewall management center affected = 7.2.10.2 fixed ? ## How to check In FMC expert mode (sudo su), run: zgrep "package_info.*license" /var/log/messages*. A hit containing /var/tmp/license.tmp (e.g. 'www : USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm') means it may have been exploited. Contact Cisco TAC if so. Hot fixes and upgrades prevent future exploitation but may not clean an existing compromise. Also check your FMC version against the fixed table, or use the Cisco Software Checker. Cisco lists Snort rules 66075-66080. ## Fix Upgrade FMC to the first fixed hardening release for your train: 7.0 and earlier -> 7.0.10; 7.2 -> 7.2.12; 7.4 -> 7.4.8; 7.6 -> 7.6.6; 7.7 -> 7.7.13; 10.0 -> 10.0.2; 10.1 -> 10.1.0. These replace the earlier hot fixes. There is no workaround. Meanwhile, keep the FMC management interface off the public internet. SCC Firewall Management needs no action. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-04-15): covers HTTP requests matched by the Cloudflare Managed Ruleset rule for Cisco Secure FMC RCE via upgradeReadinessCall (action changed from Log to Block) Limits: none stated Still: apply official vendor updates from Cisco, which the rule does not replace https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079 - 2026-10-23T21:29:00+00:00 analyst — Read Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2 (rev 2.6, 2026-09-16): CVSS 10.0, exploited since Aug 2026 per Cisco PSIRT, KEV 2026-09-09 per Canadian Cyber Centre. Fix versions and IOC from advisory. No public PoC found (not searched beyond advisory). - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20079 - 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ — Cloudflare: WAF Release - 2026-04-15 · Changelog ## Documents - [advisory] Cisco Secure FMC Software Authentication Bypass Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 - [advisory] Cloudflare: WAF Release - 2026-04-15 · Changelog https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ - [mentions] Canadian Cyber Centre AV26-197 (KEV addition 2026-09-09) https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-197 ## From the sources WAF Release - 2026-04-15 · Changelog # Changelog New updates and improvements at Cloudflare. April 15, 2026 ## WAF Release - 2026-04-15 This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869). Key Findings - Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters. - FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests. - Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body. Impact Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354) | | Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_