CVE-2026-20079Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access …
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 17.7 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
39%
Federal remediation due Sep 12, 2026
Last analysed / modified upstream
39% → 88%
3 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Sep 9, 2026. Federal remediation due Sep 12, 2026. View catalog ↗
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
secure_firewall_management_center = 7.0.0secure_firewall_management_center = 7.0.0.1secure_firewall_management_center = 7.0.1secure_firewall_management_center = 7.0.1.1secure_firewall_management_center = 7.0.2secure_firewall_management_center = 7.0.2.1secure_firewall_management_center = 7.0.3secure_firewall_management_center = 7.0.4secure_firewall_management_center = 7.0.5secure_firewall_management_center = 7.0.6secure_firewall_management_center = 7.0.6.1secure_firewall_management_center = 7.0.6.2secure_firewall_management_center = 7.0.6.3secure_firewall_management_center = 7.0.7secure_firewall_management_center = 7.0.8secure_firewall_management_center = 7.0.8.1secure_firewall_management_center = 7.0.9secure_firewall_management_center = 7.1.0secure_firewall_management_center = 7.1.0.1secure_firewall_management_center = 7.1.0.2secure_firewall_management_center = 7.1.0.3secure_firewall_management_center = 7.2.0secure_firewall_management_center = 7.2.0.1secure_firewall_management_center = 7.2.1secure_firewall_management_center = 7.2.2secure_firewall_management_center = 7.2.3secure_firewall_management_center = 7.2.3.1secure_firewall_management_center = 7.2.4secure_firewall_management_center = 7.2.4.1secure_firewall_management_center = 7.2.5secure_firewall_management_center = 7.2.5.1secure_firewall_management_center = 7.2.5.2secure_firewall_management_center = 7.2.6secure_firewall_management_center = 7.2.7secure_firewall_management_center = 7.2.8secure_firewall_management_center = 7.2.8.1secure_firewall_management_center = 7.2.9secure_firewall_management_center = 7.2.10secure_firewall_management_center = 7.2.10.1secure_firewall_management_center = 7.2.10.2secure_firewall_management_center = 7.2.11secure_firewall_management_center = 7.3.0secure_firewall_management_center = 7.3.1secure_firewall_management_center = 7.3.1.1secure_firewall_management_center = 7.3.1.2secure_firewall_management_center = 7.4.0secure_firewall_management_center = 7.4.1secure_firewall_management_center = 7.4.1.1secure_firewall_management_center = 7.4.2secure_firewall_management_center = 7.4.2.1secure_firewall_management_center = 7.4.2.2secure_firewall_management_center = 7.4.2.3secure_firewall_management_center = 7.4.2.4secure_firewall_management_center = 7.4.3secure_firewall_management_center = 7.4.4secure_firewall_management_center = 7.4.5secure_firewall_management_center = 7.4.6secure_firewall_management_center = 7.4.7secure_firewall_management_center = 7.6.0secure_firewall_management_center = 7.6.1secure_firewall_management_center = 7.6.2secure_firewall_management_center = 7.6.2.1secure_firewall_management_center = 7.6.3secure_firewall_management_center = 7.6.4secure_firewall_management_center = 7.6.5secure_firewall_management_center = 7.7.0secure_firewall_management_center = 7.7.10secure_firewall_management_center = 7.7.10.1secure_firewall_management_center = 7.7.11secure_firewall_management_center = 7.7.12secure_firewall_management_center = 10.0.0secure_firewall_management_center = 10.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-20316Medium· 5.3A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within…
CVE-2026-76504Critical· 9.8A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
CVE-2026-76460Critical· 10.0A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint
CVE-2026-20321Medium· 6.5A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user
CVE-2026-76471Critical· 9.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The…
CVE-2026-76486Critical· 9.8A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Deni…