CVE-2026-20079: Cisco Secure FMC Authentication Bypass Added to CISA KEV — Detection, Hunting, and Remediation Guide

On 2026-09-09, CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities (KEV) catalog, confirming that an authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management is being actively exploited in the wild. This is not a theoretical risk — exploitation is confirmed and ongoing.

The vulnerability is classified as an authentication bypass using an alternate path or channel (CWE-288). An unauthenticated, remote attacker can bypass the FMC authentication mechanism entirely and execute script files on an affected device, ultimately obtaining root access to the underlying operating system. For anyone who has run incident response on compromised management planes, I do not need to explain how bad this is: FMC is the centralized brain of your Cisco Secure Firewall estate. It holds your firewall policies, your device configurations, your VPN settings, and in many environments, credentials and certificates for the managed fleet. Root on FMC is effectively root on your perimeter security architecture.

If your FMC management interface is reachable from untrusted networks — and in far too many environments we assess, it is — you should treat this as an active intrusion scenario, not a patching exercise. Patch, then hunt for compromise that may have already occurred.

Technical Analysis

Affected Products

• Cisco Secure Firewall Management Center (FMC) Software — the on-premises/virtual centralized management platform for Cisco Secure Firewall (formerly Firepower/FTD) deployments
• Cisco Security Cloud Control (SCC) Firewall Management — Cisco's cloud-delivered management plane for firewall devices

Organizations should consult Cisco's official security advisory for the exact list of vulnerable and fixed software versions, as affected version ranges depend on your release train. Do not assume your version is safe because it is recent — verify against the advisory.

Vulnerability Details

• CVE ID: CVE-2026-20079
• Weakness class: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
• Attack vector: Network-accessible, unauthenticated, remote
• Impact: Authentication bypass followed by execution of script files on the affected device, leading to root-level access to the underlying operating system

How the Attack Works (Defender's Perspective)

CWE-288 vulnerabilities typically mean the application exposes a secondary interface, endpoint, or request path that was never wired into the primary authentication and authorization checks — a forgotten API route, an alternate handler, a debug/internal endpoint, or a channel (such as a direct backend service call) that trusts the front door to have already authenticated the caller.

From the description, the exploitation chain against FMC looks like this:

1. Reconnaissance: The attacker identifies an internet-reachable or internally reachable FMC web management interface (default TCP/443).
2. Authentication bypass: The attacker sends crafted requests to an alternate path or channel in the FMC web application that skips authentication validation entirely.
3. Script execution: With the authentication layer bypassed, the attacker invokes functionality that executes script files on the appliance. FMC runs on a hardened Linux base (the underlying OS is Cisco's customized Linux distribution), and the web/management stack — Apache/httpd and Java-based (Tomcat) services — processes these requests.
4. Privilege escalation to root: The script execution path yields root access to the underlying operating system, not merely application-level access. At this point the attacker has full control of the management plane.

Why Root on FMC Is Catastrophic

• Policy manipulation: Attackers can silently weaken or disable firewall policies across every managed FTD device.
• Credential and secret theft: FMC stores device credentials, certificates, and configuration archives.
• Lateral movement launchpad: FMC typically has trusted connectivity to every managed sensor and often sits in a management segment with broad reachability.
• Persistence: Root access enables implant placement below the application layer — cron jobs, systemd units, modified startup scripts — that survive application-level resets.

Exploitation Status

• CISA KEV listing: Confirmed — added 2026-09-09
• Active exploitation: Confirmed in the wild per CISA
• Federal mandate: Federal Civilian Executive Branch agencies must remediate per CISA Binding Operational Directive (BOD) 26-04 and the due date listed in the KEV catalog. All other organizations should treat the KEV due date as their own remediation deadline — this is the closest thing to a universally applicable patching SLA in our industry.

Detection & Response

Detection for this threat concentrates on three observable behaviors: (1) suspicious request patterns against the FMC web interface, (2) the FMC web/service stack spawning script interpreters or shells — the signature of successful exploitation, and (3) post-exploitation artifacts on the FMC appliance filesystem and process table. Forward FMC syslog to your SIEM if you have not already; without it, most of this hunting is impossible.

Sigma Rules

---
title: Cisco FMC Web Service Spawning Script Interpreter or Shell
id: 3f7a2b91-8c4d-4e1f-b2a6-9d5c7e0f1a2b
status: experimental
description: Detects the FMC web/management stack (httpd, Tomcat/java) spawning shells or script interpreters, consistent with post-authentication-bypass script execution via CVE-2026-20079.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/java'
      - '/catalina'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate FMC maintenance scripts executed during upgrades or health checks — baseline against your maintenance windows
level: high
---
title: Script Execution from World-Writable Directories on Cisco FMC
id: 8b1c4d62-2e5f-4a7c-93d1-6f0a8b2c3d4e
status: experimental
description: Detects execution of script files from temporary or world-writable directories, a common pattern when attackers drop and execute scripts after exploiting CVE-2026-20079 on FMC.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_ext:
    CommandLine|contains:
      - '.sh'
      - '.py'
      - '.pl'
  filter_legit:
    CommandLine|contains:
      - '/tmp/rpm'
      - '/tmp/install'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Cisco software installation and upgrade activity — correlate with change tickets before dismissing
level: high
---
title: Unauthenticated Request Patterns Against FMC Management Interface
id: 5e2f8a74-1b3c-4d9e-a6f2-7c8d9e0f1a3b
status: experimental
description: Detects HTTP requests to the FMC management interface containing path-traversal sequences or requests to internal/alternate handler paths, consistent with authentication bypass probing via an alternate path or channel (CWE-288).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '..\\'
  selection_status:
    sc-status:
      - 200
      - 302
  condition: selection_traversal and selection_status
falsepositives:
  - Vulnerability scanners and authorized penetration tests — validate source IPs against approved scanner ranges
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt assumes FMC syslog is ingested into Sentinel via a syslog forwarder (CEF or raw Syslog table). The query surfaces FMC-origin events indicating shell execution, root-level activity, or authentication anomalies on the appliance.

let lookback = 7d;
let fmc_hosts = dynamic(["fmc", "firepower", "secure-firewall-mgmt"]);
Syslog
| where TimeGenerated >= ago(lookback)
| where HostName has_any (fmc_hosts) or Computer has_any (fmc_hosts)
| where SyslogMessage has_any (
    "sudo", "root", "bash", "/bin/sh", "/tmp/", "/var/tmp/", "/dev/shm/",
    "authentication failure", "session opened for user root",
    "COMMAND=", "wget", "curl", "python", "perl"
  )
| extend Suspicion = case(
    SyslogMessage has "session opened for user root", "Root session opened",
    SyslogMessage has_any ("/tmp/", "/dev/shm/"), "Script execution from temp directory",
    SyslogMessage has "COMMAND=", "Privileged command execution",
    SyslogMessage has "authentication failure", "Authentication anomaly",
    "Other suspicious FMC activity")
| project TimeGenerated, HostName, ProcessName, SyslogMessage, Suspicion, SeverityLevel
| sort by TimeGenerated desc

Complementary network-layer hunt if your perimeter logs (firewall, proxy) land in CommonSecurityLog — look for inbound connections to your FMC management interface from sources that have no business talking to it:

let lookback = 14d;
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where DestinationHostName has_any ("fmc") or DeviceAction == "allowed"
| where DestinationPort == 443 and DestinationHostName has_any ("fmc", "firepower")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceCountry = column_ifexists("SourceCountry", ""), DestinationHostName
| where ConnectionCount > 0
| sort by FirstSeen asc

Treat any first-seen external or untrusted source IP reaching FMC as an investigation, not a tuning exercise.

Velociraptor VQL

If you are running Velociraptor against Linux infrastructure or have acquired the FMC appliance's filesystem during IR, this artifact hunts for the process and file artifacts of post-exploitation activity. Adapt for FMC's restricted shell environment where direct deployment is not feasible — run it against mounted forensic images or equivalent Linux management hosts.

-- Hunt for suspicious processes and recently dropped script files
-- consistent with CVE-2026-20079 post-exploitation on Linux appliances
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(/tmp/|/var/tmp/|/dev/shm/)'
   OR (Name =~ '(sh|bash|python|perl|curl|wget|nc)$'
       AND Username =~ '(root|www|apache|nobody)')

-- Locate recently created script files in temp and web-accessible directories
SELECT FullPath, Size, Mtime, Ctime, Mode.String AS Permissions
FROM glob(globs=['/tmp/*.sh', '/tmp/*.py', '/tmp/*.pl',
                 '/var/tmp/*.sh', '/var/tmp/*.py',
                 '/dev/shm/*', '/var/www/**/uploads/**'])
WHERE Ctime > now() - 1209600
ORDER BY Ctime DESC

Remediation and Verification Script (Bash)

Run the following on the FMC appliance via SSH (admin CLI access required) to gather verification data and hunt for indicators of compromise. FMC's Linux base restricts arbitrary tooling, so this uses standard utilities available in expert mode. Capture output to a file and preserve it as evidence before patching.

#!/bin/bash
# CVE-2026-20079 - Cisco FMC compromise assessment and pre-patch evidence collection
# Run from FMC expert mode. Requires root (sudo su -).

OUTDIR="/var/tmp/fmc_cve_2026_20079_assessment_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

echo "[+] Collecting FMC software version..."
cat /etc/sf/version 2>/dev/null | tee "$OUTDIR/fmc_version.txt"

echo "[+] Hunting for recently dropped scripts in temp directories..."
find /tmp /var/tmp /dev/shm -type f \( -name '*.sh' -o -name '*.py' -o -name '*.pl' \) \
  -mtime -30 -ls 2>/dev/null | tee "$OUTDIR/temp_scripts.txt"

echo "[+] Checking for unexpected processes spawned by web services..."
ps auxf 2>/dev/null | grep -Ei 'httpd|java' -A3 | grep -Ei 'sh$|bash|python|perl|curl|wget|nc ' \
  | tee "$OUTDIR/suspicious_children.txt"

echo "[+] Reviewing root session history..."
last root -a 2>/dev/null | head -50 | tee "$OUTDIR/root_logins.txt"
grep -i 'session opened for user root' /var/log/messages* 2>/dev/null | tail -50 \
  | tee -a "$OUTDIR/root_logins.txt"

echo "[+] Checking web access logs for traversal / bypass patterns..."
grep -Ei '\.\./|%2e%2e|\.\.%2f' /var/log/httpd/access_log* 2>/dev/null | tail -100 \
  | tee "$OUTDIR/web_traversal.txt"

echo "[+] Auditing persistence mechanisms..."
crontab -l 2>/dev/null | tee "$OUTDIR/root_crontab.txt"
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/rc.d/init.d/ 2>/dev/null \
  | tee "$OUTDIR/persistence_dirs.txt"
systemctl list-unit-files --state=enabled 2>/dev/null | grep -vi cisco \
  | tee "$OUTDIR/enabled_units.txt"

echo "[+] Checking for unexpected outbound connections..."
netstat -antp 2>/dev/null | grep ESTABLISHED | grep -viE 'ftd|sftunnel|:443 ' \
  | tee "$OUTDIR/connections.txt"

echo "[+] Assessment complete. Evidence bundle: $OUTDIR"
echo "[!] PRESERVE this bundle before patching. If any artifact fires, open an IR engagement before remediation wipes evidence."

Remediation

Act in this order. Do not patch before collecting evidence if you suspect compromise — patching can destroy the artifacts your IR team needs.

1. Confirm exposure immediately. Determine whether your FMC management interface is reachable from the internet or untrusted network segments. Search your external attack surface (Shodan/Censys checks, perimeter ACL review) for TCP/443 and any FMC administrative ports exposed externally. If exposed and unpatched, assume compromise until proven otherwise.

2. Apply Cisco's fix. Apply the mitigations and software updates exactly as directed in Cisco's official security advisory for CVE-2026-20079, available via the Cisco Security Advisories portal (https://sec.cloudapps.cisco.com/security/center/publicationListing.x) and linked from the CISA KEV catalog entry. For SCC Firewall Management (cloud-delivered), verify with Cisco that the cloud-side remediation has been applied to your tenant — you may have no action item there, but get written confirmation.

3. Meet the CISA deadline. Federal agencies are bound by BOD 26-04 and the KEV due date. Private-sector organizations should adopt the same date as an internal SLA — this vulnerability is being exploited now, and KEV due dates are calibrated to observed adversary tempo.

4. Restrict management-plane access as a compensating control. Regardless of patch status: place FMC behind a dedicated management network or jump host, enforce ACLs permitting only designated admin subnets and SCC cloud connectivity, and disable any direct internet exposure. If FMC is internet-reachable today, that is a finding independent of this CVE.

5. Hunt before and after patching. Run the detection content above against at least 30 days of retained FMC syslog, web access logs, and perimeter flow data. Prioritize: root sessions with no corresponding change ticket, web requests with traversal sequences returning 200s, and scripts in /tmp, /var/tmp, or /dev/shm.

6. If compromise is confirmed: treat FMC as fully untrusted. Rotate all credentials stored in or managed by FMC (device admin credentials, certificates, VPN pre-shared keys, any integrated directory service accounts), rebuild the appliance from known-good media rather than attempting surgical cleanup, and review all firewall policies pushed during the exposure window for unauthorized modifications. Root-level persistence on a management appliance is rarely recoverable by deletion — rebuild.

7. Verify post-patch. After remediation, re-run the assessment script to confirm a clean baseline, confirm the fixed version against Cisco's advisory, and retain the pre-patch evidence bundle per your IR retention policy.

If you need support scoping exposure, validating whether your FMC instance was compromised during the exploitation window, or rebuilding your management plane securely, this is exactly the class of engagement our incident response team handles.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub