Cisco: Cisco Secure Firewall Vulnerability Exposes Networks to Authentication Bypass Attacks

Critical Cisco Secure Firewall Flaw Grants Unauthenticated Root Access (CVE-2026-20079)

Cisco has disclosed a critical vulnerability (CVE-2026-20079) in its Secure Firewall Management Center (FMC) Software, allowing unauthenticated remote attackers to gain full root access to affected devices. With a CVSS score of 10.0, the flaw poses a severe risk to enterprise network security.

The vulnerability was discovered during internal testing by Cisco researcher Brandon Sakai and stems from an improperly initialized system process during the device’s boot sequence. Attackers can exploit it by sending crafted HTTP requests to the FMC web interface, bypassing authentication entirely. Successful exploitation enables threat actors to execute malicious scripts, alter security policies, monitor network traffic, and pivot deeper into corporate systems.

This flaw exclusively affects on-premises deployments of Cisco Secure FMC Software, regardless of configuration. No workarounds or mitigations exist, leaving unpatched systems highly vulnerable. Cloud-delivered FMC (cdFMC), Secure Firewall ASA, FTD Software, and Security Cloud Control remain unaffected.

As of March 2026, Cisco’s Product Security Incident Response Team (PSIRT) reports no evidence of active exploitation in the wild. However, organizations must immediately upgrade to a patched software release to prevent potential breaches. Cisco provides a Software Checker tool to help administrators identify vulnerable versions and apply fixes.

The flaw underscores the critical importance of timely patch management for firewall infrastructure.

Source: https://gbhackers.com/cisco-secure-firewall-vulnerability-2/

Cisco cybersecurity rating report: https://www.rankiteo.com/company/cisco

"id": "CIS1772699055",
"linkid": "cisco",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Enterprises using on-premises '
                                              'Cisco Secure FMC Software',
                        'industry': 'Technology/Networking',
                        'location': 'Global',
                        'name': 'Cisco',
                        'size': 'Large',
                        'type': 'Corporation'}],
 'attack_vector': 'Remote',
 'customer_advisories': 'Upgrade to patched software release to prevent '
                        'potential breaches',
 'date_detected': '2026-03-01',
 'date_publicly_disclosed': '2026-03-01',
 'description': 'Cisco has disclosed a critical vulnerability (CVE-2026-20079) '
                'in its Secure Firewall Management Center (FMC) Software, '
                'allowing unauthenticated remote attackers to gain full root '
                'access to affected devices. The flaw stems from an improperly '
                'initialized system process during the device’s boot sequence. '
                'Attackers can exploit it by sending crafted HTTP requests to '
                'the FMC web interface, bypassing authentication entirely. '
                'Successful exploitation enables threat actors to execute '
                'malicious scripts, alter security policies, monitor network '
                'traffic, and pivot deeper into corporate systems.',
 'impact': {'operational_impact': 'Potential execution of malicious scripts, '
                                  'alteration of security policies, network '
                                  'traffic monitoring, and lateral movement '
                                  'within corporate systems',
            'systems_affected': 'Cisco Secure Firewall Management Center (FMC) '
                                'Software (on-premises deployments)'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Importance of timely patch management for firewall '
                    'infrastructure',
 'post_incident_analysis': {'corrective_actions': 'Software patch to fix the '
                                                  'improperly initialized '
                                                  'process',
                            'root_causes': 'Improperly initialized system '
                                           'process during device boot '
                                           'sequence'},
 'recommendations': 'Immediately upgrade to a patched software release using '
                    'Cisco’s Software Checker tool',
 'references': [{'date_accessed': '2026-03-01', 'source': 'Cisco PSIRT'}],
 'response': {'communication_strategy': 'Public disclosure via Cisco PSIRT',
              'containment_measures': 'Immediate upgrade to patched software '
                                      'release',
              'remediation_measures': 'Apply Cisco-provided software patches'},
 'stakeholder_advisories': 'Enterprises using on-premises Cisco Secure FMC '
                           'Software must apply patches immediately',
 'title': 'Critical Cisco Secure Firewall Flaw Grants Unauthenticated Root '
          'Access (CVE-2026-20079)',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-20079'}