HIGH CISA-KEV ACTIVELY EXPLOITED PoC
CVE-2026-20079
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Affected Products
- Cisco: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-20079
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
This high severity vulnerability was published on 2026-09-09 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 75.8% (top 0% of all CVEs by exploitation probability). Affected: Cisco: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management.
Risk Timeline
CVE Disclosed2026-09-09 · 2 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity
Remediation Resources
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.