Cisco Firewall Management Center Authentication Bypass Vulnerability Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities Catalog. The vulnerability is an authentication bypass using an alternate path or channel (CWE-288) in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. CISA's dateAdded is 9 September 2026, and the remediation due date for federal civilian agencies is 12 September 2026. The catalogVersion is 2026.10.21. The record names no fixed version and directs readers to the vendor advisory. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.885 exploitation probability (percentile 100, as of 23 October 2026). CISA's ADP reports SSVC exploitation as active, automatable as yes, and impact as total.
Assessment
For a platform or AI-stack owner, the record lets you check whether any deployed Cisco Secure Firewall Management Center or Security Cloud Control instance is running an affected version, and decide whether to patch, isolate, or rotate the management plane until the vendor advisory's mitigations are applied. The catalog's active-exploitation and total-impact SSVC marks make the management interface the thing to verify first, since an authentication bypass there can hand an attacker control of the firewall policy itself.
For a cyber underwriter, the record lets you check whether a policyholder's firewall management surface is in scope and whether the vendor advisory's mitigations are in place, and decide whether to require that control, price the exposure, or exclude the unpatched management plane. The catalog's active-exploitation mark and the 12 September 2026 federal due date give you a concrete date against which to test whether remediation was completed on time.
What would change this call
A vendor advisory naming a fixed version, or a CISA update moving the due date or catalogVersion, would change the remediation and underwriting picture. A change in the catalog's ransomware field from Unknown would also change the assessment.
What to check next
| Check | Why |
|---|---|
| Vendor advisory for a fixed version | The record names no fixed version and points to the advisory |
| Whether FMC or SCC management interfaces are reachable | The vulnerability is an authentication bypass on the management plane |
| CISA KEV for a catalogVersion or dueDate update | The record is dated 9 September 2026 |
Confidence
Filed 23 October 2026 from the record dated 9 September 2026.
Sources
[1] Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-20079
[2] CVE record CVE-2026-20079 — https://www.cve.org/CVERecord?id=CVE-2026-20079
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog