EPSS Alert: The probability of this vulnerability being exploited in the next 30 days is 75.8% (percentile: 99%).
Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-20079 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-09 |
| Vendor | Cisco |
| Product | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management |
| CVSS Score | 10.0 (critical) |
| EPSS Score | 75.8% (percentile: 99%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-12 |
Vulnerability Description
Source: CISA KEV
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication bypass using an alternate path or channel vulnerability.
It allows an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device, obtaining root access to the underlying operating system.
The weight of this vulnerability comes from the product’s architectural role. FMC is the central management console for Cisco Secure Firewall — the place where security policies are defined and distributed. The impact therefore does not stop at a single host: it reaches the layer that governs rules on every device attached to that console.
CVSS 10.0 is the top of the scale. The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-12 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
High Exploitation Risk
According to EPSS (Exploit Prediction Scoring System), the probability of this vulnerability being exploited within 30 days is very high (75.8%). We recommend treating this update as a priority.
Who Is Affected?
This vulnerability affects organisations running Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management.
Check first whether the FMC management interface is reachable from an untrusted network — management consoles are often exposed “temporarily” to support remote work and then stay that way for years. Also verify whether your instance runs a release the vendor no longer patches.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
