Executive Summary
Cisco has disclosed a critical vulnerability (CVE-2026-20079) in the web interface of its Secure Firewall Management Center (FMC) Software with a CVSS score of 10.0. The flaw stems from an improper system process created at boot time, which allows an unauthenticated remote attacker to bypass authentication mechanisms. By sending crafted HTTP requests, an attacker can execute arbitrary script files and commands, ultimately gaining root access to the underlying operating system.
The vulnerability affects on-premise Cisco Secure FMC installations and the SaaS-delivered Cisco Security Cloud Control (SCC) Firewall Management. While Cisco has already updated SCC environments, on-premise users must apply specific hot fixes immediately. The risk is significantly higher for devices where the management interface is exposed to the public internet.