A vulnerability in the web interface of Cisco Secure Firewall Management Center

CVE-2026-20079 is an authentication bypass in the web management interface of Cisco Secure Firewall Management Center (FMC). A boot-time system process (csm_processes) creates a persistent session with hardcoded credentials (report:snortrules) that lacks proper authentication controls. An unauthenticated, remote attacker can upgrade this machine session, extract a CSRF token, write a malicious payload via sajaxintf.cgi, and execute it as root through pjb.cgi. The window is widest immediately after a reboot or on FMC instances that see little admin interaction (which clears the stale session). All on-premises FMC releases from 6.4 through 10.0 are affected. Cloud-Delivered FMC, ASA, FTD, and Security Cloud Control are not vulnerable.

Cisco rated this a perfect 10.0 and that score is earned. The attack is unauthenticated, remote, requires no user interaction, and ends in root on a device that controls your entire firewall fleet. The boot-time session window adds real friction — active admin consoles and cloud-managed session interactions clear the exploitable session — but this does NOT meaningfully reduce severity. FMC reboots happen during maintenance windows and upgrades, attackers can wait and scan, and many secondary/DR FMC instances sit idle for weeks. Cisco updated the advisory on July 29, 2026, adding hot fixes and IoCs, and CISA added the CVE to the Known Exploited Vulnerabilities catalog with an August 1 FCEB remediation deadline. The vendor severity is appropriate.

Why this verdict

• Unauthenticated remote root — no credentials, no user interaction, full root shell on the FMC appliance via crafted HTTP requests to the management interface.
• Role multiplier: fleet-scale blast radius — FMC is the centralized management plane for all Cisco FTD firewalls. Root on FMC = ability to push malicious firewall policies, disable security controls, or pivot to every managed device. 100% of FMC installs occupy this high-value role by definition. Blast radius: fleet-scale.
• Active exploitation + public PoC — CISA KEV-listed with August 1 FCEB deadline. Multiple public PoC repos on GitHub. VulnCheck published full exploit chain analysis with PCAPs and YARA rules. The boot-time window is a documented friction point but attackers are clearly overcoming it in the wild.
• Boot-time window is narrowing friction, not a blocker — the exploitable session persists until admin interaction clears it. Idle FMC instances, DR/standby units, and post-maintenance-reboot windows are all exploitable. Attackers can scan continuously and strike during the window.

Why not higher?

A 10.0 score would be appropriate if the exploit worked at any time regardless of boot state. The boot-time session window is a genuine constraint — on actively-used primary FMC consoles, admin interactions clear the vulnerable session relatively quickly. This single friction point justifies a 0.2 reduction from the vendor's perfect 10.0, but no more given the exploit works reliably on idle and recently-rebooted instances.

Why not lower?

Downgrading below CRITICAL is blocked by the role-multiplier floor: FMC is definitionally a high-value component where 100% of installs manage firewall fleets. Root compromise cascades to every managed FTD device — this is fleet-scale impact. The vulnerability is unauthenticated and remote with public PoC and confirmed active exploitation (KEV-listed). The management-VLAN argument reduces internet exposure but does nothing against post-initial-access attackers, which is exactly the threat model for network management planes.

1. Restrict FMC management interface to dedicated management VLAN with ACLs — Ensure the FMC web interface is only reachable from hardened jump boxes on a dedicated management network. Block all direct internet access to FMC. This is the single most impactful control since the exploit requires HTTP access to the management interface. Deploy within 3 days per noisgate mitigation SLA for CRITICAL findings.
2. Deploy Snort rules 66075-66080 on network IDS/IPS — Cisco published detection signatures for the crafted HTTP requests used in this exploit chain. Deploy these rules in IPS mode (blocking) on any sensor monitoring traffic to the FMC management interface. Deploy within 3 days.
3. Monitor /var/tmp/license.tmp and sajaxintf.cgi access — Set up file integrity monitoring for /var/tmp/license.tmp creation post-boot. Alert on any HTTP POST requests to /sajaxintf.cgi containing validateLicense calls and any requests to /pjb.cgi with upgradeReadinessCall. These are direct IoCs from the exploit chain.
4. Minimize FMC reboot windows and ensure admin session is active post-boot — After any FMC reboot or maintenance window, immediately log into the web console to clear the boot-time session. This closes the exploitation window. Document this as a mandatory post-maintenance step.
5. Audit for internet-exposed FMC instances immediately — Run Shodan/Censys/FOFA queries for your organization's IP ranges looking for FMC web interface fingerprints. Any internet-facing FMC is an immediate priority for patching or network isolation.

Run this script on the FMC appliance itself via SSH as root, or from an auditor workstation with SSH access. Usage: bash check_cve_2026_20079.sh <fmc_host> (if remote) or bash check_cve_2026_20079.sh (if local). Requires root/admin SSH access to the FMC appliance.

#!/bin/bash
# CVE-2026-20079 - Cisco FMC Authentication Bypass Check
# Checks FMC software version against known-vulnerable ranges
# Run on the FMC appliance or via SSH
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ "$#" -ge 1 ]; then
  # Remote check via SSH
  FMC_HOST="$1"
  VERSION=$(ssh "admin@${FMC_HOST}" "show version" 2>/dev/null | grep -oP '(?<=Version )\S+' || true)
else
  # Local check
  if [ -f /etc/sf/ims.conf ]; then
    VERSION=$(grep VERSION /etc/sf/ims.conf 2>/dev/null | head -1 | cut -d= -f2 | tr -d '"' || true)
  elif command -v show version &>/dev/null; then
    VERSION=$(show version 2>/dev/null | grep -oP '(?<=Version )\S+' || true)
  else
    VERSION=""
  fi
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine FMC version"
  exit 2
fi

echo "Detected FMC version: $VERSION"

# Check for boot-time session indicator
if [ "$#" -lt 1 ]; then
  if [ -f /var/tmp/license.tmp ]; then
    echo "WARNING: /var/tmp/license.tmp exists - potential IoC detected!"
  fi
fi

# Known patched versions (hot fix builds)
# 7.0.x hotfix, 7.2.x hotfix, 7.4.x hotfix, 7.6.x hotfix, 7.7.12-3+, 10.0.x hotfix
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | cut -d- -f1)
BUILD=$(echo "$VERSION" | cut -d- -f2 2>/dev/null || echo "0")

# Version comparison logic
if [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 7 ]; then
  if [ "$PATCH" -ge 13 ]; then
    echo "PATCHED - FMC version $VERSION is not vulnerable to CVE-2026-20079"
    exit 0
  elif [ "$PATCH" -eq 12 ] && [ "$BUILD" -ge 3 ]; then
    echo "PATCHED - FMC version $VERSION includes the hot fix for CVE-2026-20079"
    exit 0
  fi
fi

# Check if version is in affected range (6.4 through 10.0)
if [ "$MAJOR" -ge 6 ] && [ "$MAJOR" -le 10 ]; then
  echo "VULNERABLE - FMC version $VERSION is in the affected range for CVE-2026-20079"
  echo "Action: Apply Cisco hot fix immediately. Check https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"
  exit 1
else
  echo "UNKNOWN - FMC version $VERSION could not be conclusively assessed"
  exit 2
fi

Sources

1. Horizon3 - CVE-2026-20079 Technical Analysis
2. VulnCheck - Cisco FMC Auth Bypass RCE Analysis
3. Cisco Security Advisory
4. The Hacker News - Cisco FMC Zero-Day Actively Exploited
5. BleepingComputer - Cisco FMC Static Credential Flaw
6. eSentire - Maximum Severity Cisco FMC Vulnerabilities
7. CyCognito - Emerging Threat Analysis
8. NVD - CVE-2026-20079 Detail