DaystoPatch

CiscoExploited incident

Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

CVE-2026-20079Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 9 Sep 2026

  • Exploited after a fix existed
FixedFixed for every supported version 147 days after the first public report.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
147d
First public report to first fix
Follow-through
147d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2, v1.0 (Wayback snapshot 2026-03-04)CuratedQuote verified

    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

    Coordinated disclosure: v1.0 (First Published 2026 March 4 16:00 GMT) is the first public signal that the bug exists; exploitation was reported later (2026-09-09 candidates).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:78b95a6d0482ad4d…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2ClaimedQuote verified4 Mar 2026, 16:00 UTC

    Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:17dfe975193e1f3a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20079ClaimedQuote verified4 Mar 2026, 17:17 UTC

    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:154b50c266d9f064…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Mar 2026, 18:07 UTC

    2 perfect 10s from Cisco today! First up, CVE-2026-20079, auth bypass in Cisco Secure Firewall Management, by way of a...rogue process launched at boot?

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet27 Jul 2026, 21:47 UTC

    one from last month: https://app.opencve.io/cve/CVE-2026-20181 . One from earlier this year: https://app.opencve.io/cve/CVE-2026-20079 . Or this one: https://app.opencve.io/cve/CVE-2026-20127 . How about this one: https://app.opencve.io/cve/CVE-2026-20182 . Commercial networking equipment security

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-20079)ClaimedQuote verified9 Sep 2026

    Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Added to CISA's KEV catalog on 2026-09-09.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco Talos blog: Active exploitation of Cisco Secure Firewall Management Center vulnerabilitiesCuratedQuote verified9 Sep 2026

    Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability

    Post dated 'Wednesday, September 9, 2026 12:08' with no time zone shown, so day precision. Talos describes three clusters by different actors (UAT-12197, UAT-11823, UAT-11988); see notes on grouping.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5880a7a8283d8a7b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2, revision 2.5 (Wayback snapshot 2026-09-10)CuratedQuote verified9 Sep 2026, 16:00 UTC

    In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

    Snapshot header reads 'Last Updated: 2026 September 9 16:00 GMT Version 2.5', revision 2.5 'Updated to indicate that active exploitation has been observed.' dated 2026-SEP-09. The live page now dates revision 2.5 as 2026-SEP-16 (see notes).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6ecea562b365d4ea…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet9 Sep 2026, 16:28 UTC

    Cisco Talos warns of Cisco FMC vulnerabilities actively exploited in the wild. Attackers chain CVE-2026-20079 and CVE-2026-20316 to deploy ransomware. # CiscoFMC # Cybersecurity # CVE202620079 # Ransomware # InfoSec https:// securityonline.info/cisco-fmc- vulnerabiliti

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2CuratedQuote not checked yet

    First Published: 2026 March 4 16:00 GMT

    Published in the March 2026 semiannual Secure Firewall bundled publication; v1.0 said Cisco was not aware of malicious use.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2ClaimedQuote verified4 Mar 2026, 16:08 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:720d0ca4e5103e21…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +147d

    Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2, revision 2.0 (Wayback snapshot 2026-07-30)CuratedQuote verified

    Cisco has released the following hot fixes to address this vulnerability. Customers can download the hot fixes from the Software Center on Cisco.com.

    Snapshot header: 'Last Updated: 2026 July 29 15:55 GMT Version 2.0'; revision 2.0 'Added Cisco Bug ID CSCwt95974, indicators of compromise, and hot fixes.' dated 2026-JUL-29 in the snapshot (2026-JUL-31 on the live page). Under R1 this is the first complete fix: the March 2026 releases are no longer counted (see notes).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5e74b69524c1a26a…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2ClaimedQuote verified29 Jul 2026, 15:55 UTC

    Added Cisco Bug ID CSCwt95974, indicators of compromise, and hot fixes.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:720d0ca4e5103e21…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2ClaimedQuote verified5 Aug 2026, 14:37 UTC

    Updated information about customer action with hot fixes.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:720d0ca4e5103e21…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +147d

    Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2, revision 2.0 (Wayback snapshot 2026-07-30)CuratedQuote verified

    Last Updated: 2026 July 29 15:55 GMT

    Revision 2.0 lists hot fixes for every FMC train (7.0, 7.2, 7.4, 7.6, 7.7, 10.0); hot fixes count under R6. The 2026-09-16 hardening releases (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0) later replaced them.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5e74b69524c1a26a…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-onprem-fmc-authbypass-5JPp45V2

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

    Version table: 7 rows added and 6 rows removed. One new row reads "7.0 and earlier | 7.0.10". Revision 2.5 date changed from 2026-09-09 to 2026-09-16.

    • Fixed versions
    • Revision date changed
    Version table rows
    Before7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar; 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar; 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar; 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar
    After7.0 and earlier | 7.0.10; 7.2 | 7.2.12; 7.4 | 7.4.8; 7.6 | 7.6.6
    Revision 2.5 date
    Before2026-09-09
    After2026-09-16
    Earlier version captured 10 Sep 2026, 11:43 UTC: archived copyLater version captured 25 Sep 2026, 03:56 UTC: archived copyRecovered from archived copiesSnapshots 51d2b3ef3b… and 720d0ca4e5…Incident page

  2. cisco-sa-onprem-fmc-authbypass-5JPp45V2

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 6 Aug 2026, 02:51 UTC: archived copyLater version captured 10 Sep 2026, 11:43 UTC: archived copyRecovered from archived copiesSnapshots 7b95f13b82… and 51d2b3ef3b…Incident page

  3. cisco-sa-onprem-fmc-authbypass-5JPp45V2

    Recorded in the revision history

    Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

    Revision 2.0 date changed from 2026-07-29 to 2026-07-31.

    • Revision date changed
    Revision 2.0 date
    Before2026-07-29
    After2026-07-31
    Earlier version captured 30 Jul 2026, 21:03 UTC: archived copyLater version captured 6 Aug 2026, 02:51 UTC: archived copyRecovered from archived copiesSnapshots 40973dcabc… and 7b95f13b82…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Secure Firewall Management Center (FMC) Software
How we built this timeline

R1 DECISION (correction pass 23 Oct 2026): the March 4 v1.0 release is not counted as a fix. v1.0 claimed 'Cisco has released software updates that address this vulnerability.' but gave no per-release table. Revision 2.0 (29 Jul 2026) added a second bug ID (CSCwt95974) and hot fixes.

The advisory's final Fixed Releases table lists only the September 2026 hardening releases as 'First Fixed Release' (e.g. 7.4 -> 7.4.8), so every earlier release, including the March builds, is described as affected; the only exception it names is the earlier hot fixes ('Note: Previously, hot fixes were provided to remediate this vulnerability. At the time of this update, the hardening releases in the preceding table have been published and include the fix for this vulnerability').

Hence First fix = Fixed for all versions = the 29 Jul 2026 hot-fix revision. Exposure from the 4 Mar 2026 disclosure is about 147 days. exploited before a fix=false under R4: the hot fixes were public on 29 Jul 2026, and the earliest public evidence of exploitation is 9 Sep 2026 (Talos; advisory revision 2.5).

Cisco says it became aware in August 2026. Timeline: v1.0 4 Mar 2026 -> v2.0 29 Jul 2026 (same day as the static-credential advisory CVE-2026-20316, same hot-fix packages) -> v2.5 9 Sep 2026 -> v2.6 16 Sep 2026 (hardening releases replace hot fixes).

SILENT RE-DATING: Wayback snapshots show revision 2.0 dated 2026-JUL-29 (Last Updated 2026 July 29 15:55 GMT) and revision 2.5 dated 2026-SEP-09 (Last Updated 2026 September 9 16:00 GMT); the live page now dates 2.0 as 2026-JUL-31 and 2.5 as 2026-SEP-16. We use the snapshot dates.

Grouping: kept separate from cisco-cve-2026-20316 (R7 disclosure dates are more than 14 days apart: 4 Mar 2026 vs 29 Jul 2026); Talos reports both exploited, only cluster UAT-11823 used both.

Related

Cisco report card