Posted on

Cisco Secure FMC CVE-2026-20079 – Actively Exploited Authentication Bypass to Root

Threat Overview

Cisco updated its Secure Firewall Management Center advisory on September 9, 2026 to confirm active exploitation of CVE-2026-20079. The CVSS 10.0 authentication bypass affects the FMC web interface. Cisco states that an unauthenticated remote attacker can send crafted HTTP requests to bypass authentication, execute scripts and commands, and obtain root access to the underlying operating system. Cisco also publishes a concrete compromise indicator: FMC logs containing execution of /usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm by the web user through sudo may indicate exploitation. Cisco warns that hotfixes prevent future exploitation but may not remediate an already compromised appliance. The exact malicious HTTP request path or actor infrastructure has not been disclosed.

References

Impacted Systems

Vendor/product: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. Deployment: self-managed/on-premises FMC is the customer-actionable exposure; Cisco states SCC SaaS was patched by Cisco. Attack surface: FMC web management interface over HTTP(S). Authentication: none. Impact: root operating-system access. Cisco explicitly confirms Firewall Device Manager, Secure Firewall ASA Software, and Secure Firewall Threat Defense Software are not affected. Cisco lists FMC hotfixes for release trains 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0; use Cisco Software Checker/advisory guidance for the exact fixed release.

Why this matters

A remotely reachable firewall-management plane that can be taken over as root can expose firewall policy, managed-device trust, credentials, configuration, and administrative control across downstream security infrastructure. Confirmed exploitation makes this an immediate hunt and remediation priority.

Exploitation Status

Confirmed active exploitation. Cisco PSIRT stated on September 9, 2026 that it became aware in August 2026 of active exploitation. CISA added CVE-2026-20079 to KEV on September 9. Cisco has not publicly attributed the activity or published the malicious crafted HTTP request.

What this hunt looks for

Cisco-published appliance IOC strings in forwarded Syslog, new or high-volume sources reaching known FMC management interfaces, unusual privilege/account activity on FMC appliances, and rare outbound connections from known FMC IP addresses.

Required logs

  • Syslog from Cisco FMC for the vendor IOC and appliance activity hunts
  • CommonSecurityLog or equivalent network/security-device telemetry covering traffic to and from FMC management IPs

First Pass – Cisco-Published FMC Exploitation Indicator

let FMCHosts = dynamic(["REPLACE_WITH_FMC_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(30d)
| where array_length(FMCHosts) == 0 or Computer in~ (FMCHosts)
| where SyslogMessage contains "/var/tmp/license.tmp" and SyslogMessage contains "package_info"
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Cisco-Published Sudo Pattern for package_info.pl

let FMCHosts = dynamic(["REPLACE_WITH_FMC_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(30d)
| where array_length(FMCHosts) == 0 or Computer in~ (FMCHosts)
| where SyslogMessage contains "package_info.pl" and SyslogMessage contains "/var/tmp/license.tmp"
| where SyslogMessage has "sudo" or SyslogMessage contains "USER=root"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

New Sources Reaching FMC Web Management Interfaces

let FMCIPs = dynamic(["REPLACE_WITH_FMC_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (FMCIPs)
| where DestinationPort in (443,80)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (FMCIPs)
| where DestinationPort in (443,80)
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

High-Volume Sources Targeting FMC Web Management

let FMCIPs = dynamic(["REPLACE_WITH_FMC_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (FMCIPs)
| where DestinationPort in (443,80)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, bin(TimeGenerated,15m)
| where Connections >= 25
| order by LastSeen desc

Rare Outbound Destinations From FMC Appliances

let FMCIPs = dynamic(["REPLACE_WITH_FMC_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where SourceIP in (FMCIPs)
| summarize by DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where SourceIP in (FMCIPs)
| join kind=leftanti Baseline on DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

FMC Appliance Authentication and Privilege-Change Syslog Anomalies

let FMCHosts = dynamic(["REPLACE_WITH_FMC_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where array_length(FMCHosts) == 0 or Computer in~ (FMCHosts)
| where SyslogMessage has_any ("sudo","useradd","usermod","passwd","authentication failure","session opened","sshd")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Detection Notes

Highest signal is the Cisco-published /var/tmp/license.tmp plus package_info.pl log pattern. New-source and high-volume web-interface queries are exposure/anomaly pivots, not exploit signatures, because Cisco has not disclosed the malicious request. NAT, proxies, or load balancers may hide the true source. If FMC appliance logs and management-plane traffic are not ingested, Sentinel may have little or no direct visibility into exploitation.

Leave a comment