CVE-2026-20079Vulnerability

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 9 Sep 2026.

Reported by 5 independent sources · first reported 9 Sep 2026 by Cisco Talos · last reported 13 Oct 2026

Last reported 11 days ago

CISA KEVAdded 9 Sep 2026
Fix due 12 Sep 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS88.5%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

6 reports, newest first · the exact sentence from each

“CVE-2026-20079”

Recorded FutureVendor13 Oct 2026
September 2026 CVE Landscape
“Regarding breaches of perimeter devices, exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway, as well as CVE-2026-20079 in Cisco Secure Firewall Management Center (FMC), CVE-2026-20316 were confirmed.”

AhnLab ASECVendor6 Oct 2026
Q3 2026 Attack Techniques Trend Report
“CVE-2026-20079”

Cisco PSIRTVendor16 Sep 2026
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
“CVE reference: CVE-2026-20079”

Rapid7Vendor11 Sep 2026
Metasploit Wrap Up: This One Goes to Sixteen!
“…isco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software: CVE-2026-20079 and CVE-2026-20316.”

Cisco TalosVendor10 Sep 2026
We've got one word for it, and it's usually the wrong one
“First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco’s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operat…”

Cisco TalosVendor9 Sep 2026
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Indicators reported together

named in the same reports

9f1f11a708d393e0…06f18ffcc507in 1 report
2915b3f8b703eb744fc54c81f4a9c67fin 1 report
w32.9f1f11a708-100.sbx[.]tgin 1 report
9896a6fcb9bb5ac1…66decd6a4a7fin 1 report
38de5b216c33833af710e88f7f64fc98in 1 report

Copy these 5 indicators · defanged

5 indicators, defanged, one per line

9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
2915b3f8b703eb744fc54c81f4a9c67f
w32.9f1f11a708-100.sbx[.]tg
9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
38de5b216c33833af710e88f7f64fc98

Also named with it: CVE-2026-20316, CVE-2026-81578, CVE-2026-82078, CVE-2026-83548, CVE-2026-83549, CVE-2026-88771, CVE-2026-88772, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-85046, CVE-2026-85880, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964

Thanks — we review every report.

Report a wrong value