CVE-2026-20079: Cisco FMC authentication bypass gives root without a login

What it is

The web interface of Cisco Secure Firewall Management Center (FMC) can be tricked, with crafted HTTP requests, into skipping authentication. The attacker can then run scripts and get root on the FMC’s operating system, with no account. Cisco scores it 10.0 and attributes it to an improper system process created at boot time (CWE-288).

FMC manages your firewalls. Root on it means access to the configuration of every managed device, stored credentials and a foothold next to your Active Directory.

Cisco fixed this in March 2026 and learned of exploitation in August. A public proof of concept followed on August 20, and CISA added the CVE to KEV on September 9. Cisco Talos describes three clusters:

• UAT-12197 exploits this CVE, drops a JSP web shell and a JAR command runner, and queries FMC’s database for user authentication data.
• UAT-11823 (a Sandworm-overlapping group, per Talos) uses this CVE or static credentials. It replaces license.tmp with a reverse shell and installs a Cyclops Blink variant.
• UAT-11988 looks like a Qilin ransomware affiliate. Talos says it logs in with static credentials (the related CVE-2026-20316), not this bug. It is included because it hits the same boxes.

CISA lists ransomware use of this CVE as “Unknown”.

Am I affected?

Yes, if you run on-premises Cisco Secure FMC on any version below the fixed releases in the table above. Cisco says it applies regardless of device configuration. The CVE record lists 7.0 to 7.7 and 10.0.0 to 10.0.1 as affected.

Cisco notes that the attack surface is smaller if the FMC management interface isn’t reachable from the internet. It isn’t a fix: an attacker with any network path to the web interface can use it.

Not affected: Firewall Threat Defense (FTD), ASA, Firewall Device Manager and Security Cloud Control. Cisco has already fixed the SaaS Security Cloud Control Firewall Management.

Use Cisco’s Software Checker to confirm your release.

What to do

1. Upgrade FMC to a fixed hardening release (table above). Cisco’s hardening releases also fix other internally found bugs. There are no workarounds.
2. Take the management interface off the internet. Restrict it to admin networks. This reduces exposure but does not replace the upgrade.
3. Check for compromise before and after upgrading (Detection below). Cisco says its hot fixes and upgrades prevent future exploitation but may not clean an existing compromise.
4. If you find signs of exploitation, call Cisco TAC straight away and follow their guidance. Treat FMC as fully compromised: assume managed-device configurations and credentials in FMC, and any AD service-account credentials it held, were read. Rotate them.
5. Add Snort coverage. Cisco lists Snort rules 66075 to 66080 for this CVE. Talos lists 66883 for CVE-2026-20316 and 66960, 66961 for the malware.

CISA’s KEV entry also refers to BOD 26-04, including its forensics triage requirements, for federal agencies.

Detection

Cisco’s check. From expert mode, escalate to root and search the system log:

sudo su
zgrep "package_info.*license" /var/log/messages*

A line referencing /var/tmp/license.tmp, such as COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp, means the device may have been exploited.

From Talos’s analysis:

• home.jsp or other unexpected JSP files in the Tomcat webroot, and cmd.jar run with /var/jre/bin/java -jar. The shell decodes a parameter named F6C1F0E7.
• A FIFO at /tmp/f with nc or /bin/sh -i processes, and outbound connections to the C2 addresses above, notably port 3090.
• Invocations of package_info.pl /var/tmp/license.tmp --lsm, and a license.tmp that is a Makeself package.
• Unrecognised scripts under /etc/init.d/ (Cyclops Blink persistence).
• Database queries through /var/sf/bin/OmniQuery.pl that read user authentication data.
• A Python SOCKS5 proxy (socks5.py) and reverse-SSH tunnels from FMC, forwarding ports 389, 636, 88, 445, 135 and 5985.
• Staged files on FMC pulled out with HTTP GET requests.
• Static-credential logins to FMC (the UAT-11988 cluster).
• Later, in the network: impacket, Invoke-TheHash and antivirus killers on endpoints, which come before Qilin ransomware.

Cisco says it learned of exploitation in August 2026, so search back at least to then, and further if your FMC was unpatched and reachable earlier.