Summary
generated automatically from NVD dataCisco Secure Firewall Management Center (FMC) Software has a flaw in its web interface, tied to an improper system process created at boot time, that lets an unauthenticated remote attacker bypass authentication (CWE-288). By sending crafted HTTP requests, the attacker can run script files and commands and gain root access to the underlying operating system. The issue is rated CRITICAL with a CVSS v3.1 score of 10.0, and it is listed in the CISA KEV catalog, which indicates active exploitation.
NVD description
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-09. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-12
EPSS · FIRST.org
88.2%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 4 mars 2026
- Updated
- 16 sept. 2026
- Status
- Analyzed
- Source
- psirt@cisco.com
Affected products
Weaknesses (CWE)
References (4)
- http://seclists.org/fulldisclosure/2026/Aug/80ExploitMailing ListThird Party Advisory
- https://blog.talosintelligence.com/fmc-ongoing-exploitation/ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-288
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.