Secure Firewall Management Center
CVE-2026-20079
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP requests to web interface
-
ExploitBypass authentication mechanism
-
ExecutionExecute arbitrary scripts with root privileges
-
ImpactAchieve system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Cisco Secure Firewall Management Center (FMC) with vulnerable web interface accessible over network. Improper system process created at boot time must be present. No authentication credentials required. Remote unauthenticated exploitation possible against default FMC deployments. |
| Impact | CVSS 10.0. FMC manages firewall policies for entire networks. |
| Exploit ScenarioDerived | Bypass auth to manage firewall rules, disable security controls. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated auth bypass in Cisco FMC web interface. CVSS 10.0.
Earlier versions of this analysis (1)
Auth bypass in Cisco Firewall Management Center.
RemediationAI
Apply Cisco security update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-288.
Know when Secure Firewall Management Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Articles & Coverage 1
Executive ViewAI
A critical vulnerability in Cisco Secure Firewall Management Center allows unauthenticated attackers to gain complete control of affected devices without any patch currently available. Organizations using this platform face immediate risk of unauthorized access, data exfiltration, and lateral movement into protected networks.
Implement network segmentation to restrict FMC web interface access to authorized administrative subnets only. Deploy WAF rules blocking unauthenticated script execution attempts. Disable unnecessary web interface features if operationally feasible. Enable enhanced logging and real-time threat monitoring on FMC instances. Restrict FMC administrative access to VPN-only connections with multi-factor authentication. Monitor vendor security advisories hourly for emergency patch releases.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users
The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via
Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerl
A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authent
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software cou
The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Ada
The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x bef
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could
Exploit-DB