Cisco patches max-severity Secure Firewall Management Center flaws enabling unauthenticated root access

Cisco released security updates for two maximum-severity vulnerabilities in Cisco Secure Firewall Management Center (FMC) that can be exploited remotely by unauthenticated attackers via crafted HTTP requests to the web-based management interface. The issues include an authentication bypass (CVE-2026-20079) that can lead to root access on the underlying operating system and a remote code execution flaw (CVE-2026-20131) that allows execution of arbitrary Java code as root on unpatched systems.

The Canadian Centre for Cyber Security highlighted Cisco’s advisories and urged administrators to review Cisco guidance and apply updates, noting impact to Cisco Security Cloud Control (SCC) Firewall Management and Cisco Secure FMC across versions. Cisco stated its PSIRT had no evidence of active exploitation and no public PoC at the time of publication, while also issuing fixes for additional vulnerabilities (including multiple high-severity issues) across Cisco firewall management and firewall platforms.