CVE-2026-2007910.0CriticalCWE-288
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
Exploited in the wild · in CISA KEV since 9 SepExploitation attributed to UAT-11823 (per Cisco Talos, SecurityOnline); UAT-11988 (per Cisco Talos, SecurityOnline); UAT-12197 (per Cisco Talos, SecurityOnline); Qilin (per Cisco Talos, Security Affairs); Sandworm (per Cisco Talos, SecurityWeek)
88.7%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 9 Sep · catalogue entry
Passed 52 days ago
DescriptionNVD
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage14 articles · 7 outlets
One row per outlet, in order of first report; the chart covers the last 90 days. First in our coverage: Security Affairs, 4 Mar.
Quiet for 7 weekslast report 17 Sep14 articles7 outlets
- Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
- Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
- Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
- Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
- Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline, its first report on the story. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 01:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Thu 10 Sep, 11:36 UTC. The Hacker News, its first report on the story. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
- Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 6 Aug 07:51 | SecurityWeek | Cisco fixes critical flaws in Catalyst SDWAN and firewall gear |
| 9 Sep 23:28 | SecurityOnline | Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access |
| 10 Sep 01:32 | CISA | CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access |
| 10 Sep 10:30 | SecurityWeek | Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware |
| 10 Sep 11:36 | The Hacker News | CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack |
| 10 Sep 19:46 | Security Affairs | CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day |
| 11 Sep 07:48 | The Hacker News | Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware |
| 11 Sep 10:37 | Security Affairs | Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware |
| 14 Sep 22:16 | Dark Reading | Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink |
| 17 Sep 12:30 | SecurityWeek | Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation |
- Cisco Patches Dozens of Flaws as ISE Zero Day Faces ExploitationSecurityWeek · mentions it in passing
- Cisco Firewall Flaws Exploited to Deploy Qilin RansomwareSecurity Affairs
- CISA Flags Four Actively Exploited Flaws Including Cisco Zero DaySecurity Affairs · mentions it in passing
- CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root AccessCISA · official notice
- Cisco fixes critical flaws in Catalyst SDWAN and firewall gearSecurityWeek · mentions it in passing
- Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root accessSecurity Affairs · first in our coverage
New articles also arrive in the RSS feed.