Authentication Bypass to Root RCE in Cisco Secure Firewall Management Center

This repository is a small standalone exploit PoC consisting of one Python script and one README. The main file, CVE-2026-20079.py, is the only code artifact and serves as the entry point. It uses the requests library to interact with a Cisco Secure Firewall Management Center (FMC) web interface over HTTPS, explicitly disabling certificate verification to accommodate self-signed deployments. The exploit logic is a two-stage chain. First, it creates a requests session and sends a POST request to /api/fmc_config/v1/upgradeSession with parameters action=session_upgrade and partial_session=1, attempting to abuse an alleged boot-time partial session condition to bypass authentication. If the response status indicates success (200/204/302), the script treats the target as compromised at the session level. Second, if the operator supplied a command, it sends another POST request to /cgi-bin/privilegedScriptHandler.cgi with script=exec, cmd=<command>, and elevate=root, attempting to execute arbitrary commands as root. The script also includes a --shell mode, but this does not automatically establish a shell; it only prints a suggested bash reverse-shell one-liner using /dev/tcp/YOUR_IP/4444. Capabilities: unauthenticated remote authentication bypass, session hijacking, arbitrary root command execution, and operator-guided reverse-shell follow-on. Attack surface: network/web against the FMC management interface. There is no persistence, lateral movement, or post-exploitation automation beyond command execution. Repository structure is minimal and purpose-built: README.md documents the claimed vulnerability, affected versions, impact, and references, while the Python script operationalizes the exploit chain. This is not part of a larger exploit framework such as Metasploit or Nuclei. Based on the code, it is an operational PoC rather than a detection script: it actively sends exploit requests and can execute attacker-provided commands. The payload is basic and hardcoded around two HTTP POST requests, so maturity is best classified as OPERATIONAL rather than weaponized.