Maximum Severity Cisco Firewall Vulnerabilities Disclosed (CVE-2026-20079 & CVE-2026-20131)

THE THREAT

On March 4th, 2026, Cisco disclosed two maximum severity vulnerabilities impacting Cisco Secure Firewall Management Center (FMC) Software. Identified as CVE-2026-20079 (CVSS: 10.0) and CVE-2026-20131(CVSS: 10.0), both vulnerabilities allow an unauthenticated attacker to achieve Remote Code Execution (RCE) and obtain root-level privileges.

At the time of writing, there have been no confirmed reports of exploitation in the wild. However, the eSentire Threat Intelligence team assesses that exploitation is highly likely in the near term, given the severity of the vulnerabilities and the significant impact associated with successful exploitation.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins for CVE-2026-20079 and CVE-2026-20131 as they become available
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by Cisco
• Organizations are recommended to restrict FMC management interface access to trusted internal networks and reduce exposure to the public Internet

Additional Information

The flaws were disclosed as part of the March 2026 release of the Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication.

CVE-2026-20079 allows a remote attacker to bypass authentication on the web interface of Cisco Secure FMC Software and execute arbitrary scripts to obtain root-level access on a vulnerable device. The vulnerability arises from the improper creation of a system process during the device's boot sequence. An attacker can exploit the flaw by sending specially crafted HTTP requests to the affected system.

CVE-2026-20131 impacts the web-based management interface of Cisco Secure FMC Software. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary Java code with root-level privileges on the affected device. The vulnerability stems from the insecure deserialization of a user-supplied Java byte stream. The risk of exploitation is significantly reduced if the FMC management interface is not exposed to the public Internet. The flaw also affects Cisco Security Cloud Control (SCC) Firewall Management.

Cisco has confirmed that no workarounds are available to mitigate these vulnerabilities. Organizations are therefore strongly advised to upgrade to the latest secure version of Cisco Secure FMC Software immediately. Although there have been no reports of active exploitation at the time of writing, the widespread deployment of Cisco products, combined with the severity of the vulnerabilities and the impact of successful exploitation, makes it critical for organizations to prioritize the application of security updates.

References:
[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
[2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
[3] https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736