What is the CVSS score of CVE-2026-20079?

CVE-2026-20079 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco are affected by CVE-2026-20079?

A critical vulnerability in Cisco Secure Firewall Management Center allows unauthenticated attackers to gain complete control of affected devices without any patch currently available.

Is there a public PoC exploit available for CVE-2026-20079?

Yes, a public proof-of-concept exploit is available for CVE-2026-20079. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-20079?

Within 24 hours: Isolate affected FMC instances from untrusted networks and restrict administrative access to authorized personnel only. Within 7 days: Implement network segmentation to limit FMC exposure, enable comprehensive logging and monitoring for suspicious activity, and contact Cisco for interim security guidance. Within 30 days: Develop and test a migration plan to patched versions when available, and conduct forensic analysis for any unauthorized access indicators.

Cisco CVE-2026-20079

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-04 psirt@cisco.com

Cisco Authentication Bypass

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 19:39 vuln.today

Public exploit code

Government Alert

Mar 05, 2026 - 19:39 cert

Government exploitation alert

CVE Published

Mar 04, 2026 - 18:16 nvd

CRITICAL 10.0

DescriptionCVE.org

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.