Cisco Secure Firewall Management Center (FMC) - Web Management Plane Hermes rates CVE-2026-20079 at 98 (CRITICAL). As the centralized control plane managing enterprise perimeter firewalls (FTD and ASA), unauthenticated root compromise of Cisco FMC leads to the catastrophic collapse of all network segmentation, credential exposure, and immediate weaponized pivoting into internal crown-jewel segments.
Software platform affected by security vulnerabilities and agentic attack patterns.
“Confirmed security vulnerability in Cisco Secure Firewall Management Center documented in Hermes dossier.”
| Parameter | Technical Specification | Operational Impact |
|---|---|---|
| CVE Identifier | CVE-2026-20079 | Universal vulnerability identifier |
| Vendor Advisory | cisco-sa-onprem-fmc-authbypass-5JPp45V2 | Cisco Security Advisory publication |
| Cisco Bug IDs | CSCwr96008, CSCwt95974 | Cisco PSIRT engineering defect tracking |
| CVSS v3.1 Score | 10.0 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| FIRST EPSS Score | 35.95% (98.37th percentile) | Upper-tier exploitation probability |
| CISA KEV Status | Added on September 9, 2026 | Mandatory deadline: September 12, 2026 (BOD 26-04) |
| Vulnerable Component | HTTPS web management interface (boot-time process) | Port TCP 443 / 8443 |
| Required Privileges | None (Unauthenticated) | Remote network exploitation vector |
| Gained Privileges | root (Underlying Linux OS Superuser) | Total device and management takeover |
CVE-2026-20079 impacts all major active release trains of on-premises Cisco Secure FMC:
Hotfix GB-7.0.9.1-3 / version 7.0.9 or later);Hotfix HL-7.2.11.1-4 / version 7.2.11 or later);Hotfix HG-7.4.7.1-3 / version 7.4.7 or later);Hotfix CY-7.6.5.1-2 / version 7.6.5 or later);Hotfix AM-7.7.12.1-2 / version 7.7.12 or later);Hotfix P-10.0.1.1-2 / version 10.0.1 or later).The root cause of CVE-2026-20079 is categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) combined with unrestricted sudo privilege execution.
CVE-2026-20079 Execution Flow on Cisco Secure FMC:
┌─────────────────────────────────────────────────────────────┐ │ 1. Remote Unauthenticated Attacker │ └──────────────────────────────┬──────────────────────────────┘ │ Crafted HTTP requests (TCP 443) ▼ ┌─────────────────────────────────────────────────────────────┐ │ 2. Improper Boot-Time System Process │ │ • Internal dispatch handler registered during init │ │ • Fails to enforce web session authentication filters │ └──────────────────────────────┬──────────────────────────────┘ │ File write / authentication bypass ▼ ┌─────────────────────────────────────────────────────────────┐ │ 3. Temporary File Dropped on Target │ │ • /var/tmp/license.tmp (under 'www' webserver context) │ └──────────────────────────────┬──────────────────────────────┘ │ Passwordless sudo invocation ▼ ┌─────────────────────────────────────────────────────────────┐ │ 4. Privileged Perl Utility Invocation │ │ • sudo /usr/local/sf/bin/package_info.pl /var/tmp/... │ │ • Unsanitized argument parsing & command dispatch │ └──────────────────────────────┬──────────────────────────────┘ │ Elevation to operating system ▼ ┌─────────────────────────────────────────────────────────────┐ │ 5. Arbitrary Code & Script Execution as ROOT │ │ • Backdoors, reverse shells, web shell deployment │ │ • Extraction of configuration database & crypto keys │ └─────────────────────────────────────────────────────────────┘During appliance initialization, Cisco FMC launches background system daemons responsible for internal package management, licensing validation, and inter-service dispatching. One of these processes establishes local listener hooks directly mapped into the webserver (Apache/Nginx) request routing table.
However, requests directed toward these endpoints do not traverse the standard authentication validation stack (which inspects administrative session tokens and RBAC credentials). An unauthenticated remote attacker with network reachability to port 443/8443 can target these unprotected URIs to deliver arbitrary instructions.
package_info.plOnce the alternate channel is reached, the backend process accepts package and license update commands. The unprivileged web server account (www) possesses sudoers permissions to invoke the administrative Perl utility:
sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsmBy providing a crafted /var/tmp/license.tmp file or exploiting parameter injection in package_info.pl, the attacker triggers command evaluation directly within the Perl script context. Because the script executes via sudo as root, the attacker immediately attains unrestricted root shell access on the underlying Linux OS.
CVE-2026-20079 is actively exploited in the wild by sophisticated threat actors targeting edge infrastructure devices.
In enterprise network architectures, Cisco FMC orchestrates all perimeter Secure Firewall Threat Defense (FTD) sensors. Gaining root access to FMC grants attackers catastrophic capabilities:
Telemetry from Cisco Talos indicates threat actors chain CVE-2026-20079 with secondary local vulnerabilities (such as CVE-2026-20316) to establish persistent backdoors, install obfuscated web shells within FMC web directories, and configure hidden cron jobs that survive system reboot cycles.
This attack pattern mirrors large-scale edge gateway exploitation campaigns observed with Ivanti EPMM CVE-2026-1281 and critical infrastructure attacks targeting backup platforms such as Veeam Backup & Replication CVE-2026-21669.
In accordance with CISA’s Forensics Triage Requirements under BOD 26-04, incident response teams must audit Cisco FMC appliances for evidence of historical compromise.
Access the Cisco Secure FMC appliance via SSH, enter expert mode, and inspect system logs:
expertadmin@firepower:~$ sudo suroot@firepower:/home/admin# zgrep "package_info.*license" /var/log/messages*If log records contain output matching:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsmthe appliance presents a definitive indicator of compromise. The attacker has leveraged CVE-2026-20079 to invoke the privileged Perl utility with the temporary license file.
Filesystem Artifacts
/var/tmp/license.tmp or anomalous files in /var/tmp/ and /tmp/./usr/local/sf/htdocs/ or /var/www/./root/.ssh/authorized_keys or /home/admin/.ssh/authorized_keys.Network & Process Anomalies
/bin/sh, /bin/bash, nc, python).To detect and prevent network exploitation attempts targeting CVE-2026-20079, Cisco Talos published the following Snort signatures:
# Snort 2 Talos Signatures:66572, 66573, 66574, 66575, 66576, 66577, 66581, 66589, 66590, 66594, 66595, 66601, 66602, 66603, 66604
# Snort 3 Talos Signatures:301523, 301524, 301525, 301527, 301528, 301529, 301531, 301532These rules monitor inbound HTTP/HTTPS traffic targeting unauthenticated endpoints and drop requests containing malformed license and package payload parameters.
title: Potential Exploitation of Cisco Secure FMC CVE-2026-20079id: b429815c-9d0a-4e87-a2f1-6cf5439a8204status: stabledescription: Detects suspicious execution of package_info.pl with temporary license file by www web user via sudo.references: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2author: Hermes Codex Cyber Threat Intelligencedate: 2026-09-09tags: - attack.initial_access - attack.t1190 - attack.privilege_escalation - attack.t1068 - cve.2026-20079logsource: product: linux service: syslogdetection: selection: process.command_line|contains: - 'package_info.pl' - 'license.tmp' user.name: 'root' condition: selectionfalsepositives: - Rare manual licensing procedures initiated strictly during authorized administrative maintenance windows.level: critical// Hunt for suspicious Cisco FMC package_info.pl execution via SyslogSyslog| where TimeGenerated >= ago(30d)| where SyslogMessage has "package_info.pl" and SyslogMessage has "license.tmp"| extend RawCommand = extract(@"COMMAND=(.*)", 1, SyslogMessage)| extend CallingUser = extract(@"USER=([^\s]+)", 1, SyslogMessage)| project TimeGenerated, Computer, ProcessName, CallingUser, RawCommand, SyslogMessage| sort by TimeGenerated descPerimeter Isolation:
Ensure the Cisco FMC management interface is completely inaccessible from the public internet. Restrict all administrative access to dedicated Out-Of-Band (OOB) management VLANs via strict Access Control Lists (ACLs) or bastion hosts.
Forensic Pre-Upgrade Verification:
Execute zgrep "package_info.*license" /var/log/messages* in expert mode. If compromise indicators are detected, applying the hotfix will not evict established attackers. Initiate an emergency incident response procedure and engage Cisco TAC immediately.
Deploy Official Cumulative Hotfixes:
Download and install the appropriate hotfix package from the Cisco Software Center:
Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar;Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar;Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar;Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar;Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar;Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar.Post-Remediation Secret Rotation:
If suspicious activity is discovered or suspected prior to patching, perform a complete rotation of: