Cisco patches two maximum-severity Secure FMC flaws enabling root access
Summary
Cisco patched two remotely exploitable Secure FMC flaws that could let unauthenticated attackers gain root access or run arbitrary code. Cisco PSIRT reports no evidence of active exploitation or public PoC code.
Key points
- Cisco patched CVE-2026-20079, an authentication bypass that can allow remote, unauthenticated attackers to gain root access.
- CVE-2026-20079 can be exploited by sending crafted HTTP requests to an affected device.
- CVE-2026-20131 is a remote code execution flaw involving a crafted serialized Java object; successful exploitation can run code as root.
- CVE-2026-20131 also affects Cisco Security Cloud Control Firewall Management.
- Cisco PSIRT reports no evidence that either flaw is being exploited or that public proof-of-concept code is available.
- Cisco also patched dozens of other vulnerabilities, including 15 high-severity flaws in Secure FMC, Secure Firewall ASA, and Secure Firewall Threat Defense.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Severity
- Maximum severity
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
T1059 · Command and Scripting InterpreterCisco says successful exploitation of CVE-2026-20079 can allow scripts and commands to run on the device.T1190 · Exploit Public-Facing ApplicationThe flaws can be exploited remotely through crafted requests to the affected device's web-based management interface.
CVE
CVE-2026-20079Cisco · Cisco Secure Firewall Management Center (FMC)The flaws—an authentication bypass (CVE-2026-20079) and a remote code execution via serialized Java objects (CVE-2026-20131)—have been patched and Cisco PSIRT reports no current evidence of active exploitation orCVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)authentication bypass (CVE-2026-20079) and a remote code execution via serialized Java objects (CVE-2026-20131)—have been patched and Cisco PSIRT reports no current evidence of active exploitation or published
Vendors
Products
Cisco Security Cloud Control (SCC) Firewall ManagementCVE-2026-20131 is a remote code execution via a crafted serialized Java object and also affects Cisco Security Cloud Control (SCC) Firewall Management.Secure Firewall Management Center (FMC)Cisco has released security updates to fix two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) that could allow remote, unauthenticated attackers to gain root access or run arbitrary code.