Cisco's Firewall Manager Had a CVSS 10 Auth Bypass — And Attackers Were Already Inside

Root. Unauthenticated. Remote. On the single console that manages every firewall in your fleet. That's CVE-2026-20079 in three words, and it's the reason I stopped what I was doing when CISA's latest Known Exploited Vulnerabilities update landed on September 9, 2026.

I've managed Cisco estates where the Secure Firewall Management Center (FMC) was the one box nobody was allowed to touch without a change ticket, two approvals, and a rollback plan. It's the control plane. It pushes policy to every managed firewall, holds every access-control rule, and usually sits with a level of trust that no individual firewall gets on its own. Reading that this exact class of device had a CVSS 10.0 authentication bypass — and that it had already been exploited in the wild for months before CISA acted — was not a surprise so much as a confirmation of something I've been saying in every architecture review for years: we protect the edge obsessively and treat the management plane as an afterthought.

What CISA Actually Added, and Why It Matters

On September 9, 2026, CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Cisco, Citrix, and Fortinet products. Federal Civilian Executive Branch (FCEB) agencies were given until September 12, 2026 — roughly three days — to patch. For a KEV entry, that's an unusually tight window, and it tells you CISA does not consider this a routine bookkeeping update.

Figure 1: The three vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog on September 9, 2026, spanning Cisco, Citrix, and Fortinet (Source: The Hacker News).

CVE	Product	CVSS	Vulnerability Type
`CVE-2026-20079`	Cisco Secure Firewall Management Center (FMC)	10.0	Authentication bypass → root via unauthenticated script execution
`CVE-2026-19490`	Citrix NetScaler ADC / Gateway (AAA or Gateway mode)	9.3	Authentication bypass
`CVE-2025-25249`	Fortinet FortiOS, FortiSwitchManager, FortiSASE	7.3	Heap-based buffer overflow → remote code execution

All three are being actively exploited. But the one that deserves the most attention — and the reason I'm dedicating this whole piece to it — is CVE-2026-20079, because of what FMC actually is inside a network.

The Cisco FMC Bug, in Plain Terms

CVE-2026-20079 is an authentication bypass vulnerability in the web interface of Cisco Secure Firewall Management Center Software. Cisco's own advisory description is blunt: it "could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system." No credentials. No session. No social engineering. Just network reachability to the management interface and a crafted request, and the attacker ends the interaction as root on the box that configures every firewall it manages.

This isn't a new disclosure. Cisco first confirmed active exploitation of CVE-2026-20079 back in March 2026, alongside a companion RCE flaw, CVE-2026-20131, which also carried a 10.0 CVSS score and allowed an unauthenticated attacker to execute arbitrary Java code as root. Both were disclosed in the same advisory batch, both hit FMC, and both were maximum severity. That's an unusual pairing — an authentication bypass and a remote code execution flaw on the same appliance, released together — and it strongly suggests these were found through the same research effort or the same code audit, likely triggered by scrutiny after prior FMC issues.

The Exploitation Timeline Kept Getting Worse

What makes this KEV entry different from a typical "add and forget" listing is the pattern of updates Cisco has made to the same advisory over six months:

March 2026 — Cisco discloses CVE-2026-20079 and CVE-2026-20131 together, both CVSS 10.0, both affecting FMC's authentication and privilege model.
July 2026 — CISA adds a related flaw, CVE-2026-20316 (CVSS 5.3), to KEV: static, hardcoded low-privilege credentials baked into FMC software. On its own it's a lower-severity bug, but Cisco explicitly notes it can be chained with other FMC vulnerabilities to escalate privileges — which is precisely the kind of low-and-slow foothold an attacker uses in combination with something like CVE-2026-20079.
August 2026 — Cisco updates its advisory for CVE-2026-20079 again, this time to confirm it became aware of active exploitation attempts targeting the flaw. The company identifies three separate clusters of post-compromise activity on FMC instances — tracked as UAT-12197, UAT-11823, and UAT-11988 — using the bug to deploy web shells and malware.
September 9, 2026 — CISA formally adds CVE-2026-20079 to KEV alongside the Citrix and Fortinet flaws, with the compressed three-day federal patch deadline.

Read that sequence again: a maximum-severity auth bypass disclosed in March, three independent attacker clusters caught abusing it by August, and a KEV entry with an emergency deadline only in September. That's roughly six months between disclosure and the regulatory hammer coming down — plenty of time for any organization that didn't patch in March to have been sitting exposed the entire time.

Cisco Routers Weren't an Isolated Case Either

This lands in the same news cycle as a separate report from incident response firm Sygnia, which documented a China-nexus espionage group it calls Fire Ant hijacking Cisco IOS XR routers — not to break them, but to quietly turn them into collection platforms. As Sygnia put it, once the actor controlled the router, "the device became a vantage point for observing traffic moving through trusted network paths." Different product line, different CVE, same underlying theme: Cisco infrastructure that sits in a position of implicit trust is being targeted specifically because compromising it gives an attacker visibility or control far beyond the device itself.

The Other Two Entries Deserve a Look Too

Citrix NetScaler — CVE-2026-19490

This authentication bypass affects NetScaler ADC and Gateway when configured as an AAA virtual server, or as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy. It's not theoretical exploitation, either — Previdian's honeypot network recorded 56 exploitation attempts since September 3, 2026, with 36 of those hitting on September 8 alone, the day before the KEV addition. That's a clear acceleration curve, the kind you see once a working exploit starts circulating more widely among opportunistic scanners.

Fortinet FortiOS — CVE-2025-25249

This one is older (a 2025 CVE) but was added to KEV now because of a documented campaign delivering a Node.js-based RAT called PivotC2. SOCRadar's research traced more than 3,000 targeted IP addresses and 178 confirmed infections, concentrated in the U.S., attributed to a financially motivated Russian-speaking threat actor. The infection chain is worth noting for anyone doing detection engineering: a shell script with an embedded exploit binary establishes a reverse shell, runs a single-line JavaScript command through Node.js, and pulls down an encrypted second-stage payload that decrypts and executes PivotC2 — which then supports interactive shells, SOCKS5/HTTP proxy tunneling, port forwarding, CIDR-range scanning, and FortiGate-specific credential harvesting. An "auto-mode" flag even lets it run a predefined command sequence with no operator interaction at all.

My Take

I want to be direct about why this particular KEV batch bothers me more than most: two of the three products here — FMC and NetScaler — are management and access infrastructure, not endpoint-facing services. That distinction matters enormously in how I think about blast radius.

When I've built or audited firewall estates, the FMC (or whatever the equivalent management plane is for a given vendor) almost always ends up with a level of network trust that no individual firewall has on its own — because it needs to reach every managed device, push configuration, and pull logs and health data back. Compromising a single firewall is bad. Compromising the system that configures all of them is a different category of incident entirely: an attacker with root on FMC can silently rewrite access-control policy across the whole fleet, disable logging on the devices that would otherwise catch them, and use FMC's own trusted management channels to pivot inward, all while looking, from the perspective of any downstream firewall, like legitimate administrative traffic.

This is why I've never been comfortable with the common practice of putting management interfaces on the same routable network as production traffic "because it's more convenient for the ops team." Convenience for the ops team is also convenience for whoever gets past the auth check. The six-month gap between Cisco's original March disclosure and CISA's September KEV addition is also telling — it's not that the vulnerability got worse, it's that the evidence of active abuse accumulated to the point where CISA felt it had to force the issue with a hard deadline. That gap is exactly the window where organizations that treat CVSS 10.0 disclosures as "patch when convenient" get burned.

The static-credential bug Cisco disclosed in July (CVE-2026-20316) is the detail I'd flag to anyone who thinks a single patch closes this out. Cisco explicitly said it can be chained with other FMC vulnerabilities for privilege escalation. Vulnerability chaining on management appliances is exactly the pattern I'd expect from the "post-compromise activity clusters" Cisco mentioned — attackers rarely need just one bug when the platform has several sitting in the same trust boundary.

What You Should Do Right Now

Patch FMC immediately if you haven't. Check your version against Cisco's advisory for cisco-sa-onprem-fmc-authbypass-5JPp45V2 and apply the fixed release or hotfix for your train (7.0, 7.2, 7.4, 7.6, 7.7, or 10.0).
Assume compromise if your FMC management interface has ever had public internet exposure. Run Cisco's indicator-of-compromise check for the related static-credential issue: cat /var/log/messages | grep license in expert mode on the FMC device. If the output references /var/tmp/license.tmp, treat that instance as potentially compromised and begin incident response, not just patching.
Pull FMC management interfaces off the public internet entirely. There is no legitimate reason for a firewall management console to be reachable from anywhere except a dedicated, access-controlled management network or a jump host behind MFA.
If you run NetScaler as an AAA virtual server or Gateway, patch CVE-2026-19490 now — the honeypot data shows exploitation attempts actively accelerating, not tapering off.
If you run FortiOS, FortiSwitchManager, or FortiSASE, check your version against FG-IR-25-084 and hunt for the PivotC2 infection chain specifically: outbound TLS connections to unfamiliar C2 infrastructure, unexpected Node.js processes, and reverse shell activity originating from the firewall itself rather than a management host.
Audit who and what can reach your management plane — not just FMC, but any single console that configures multiple downstream security devices. If compromising one box gives an attacker control over your entire perimeter, that box needs a materially higher security bar than the devices it manages, not the same one.
Rotate credentials on any FMC instance that was ever internet-facing, given the static low-privilege credential issue disclosed alongside this bug.

This article was researched and drafted with AI assistance as part of an experiment in building a faster tech-writing workflow, then reviewed and edited before publishing.

Primary source: CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline — The Hacker News, September 10, 2026

Secondary sources: Cisco FMC Zero-Day Actively Exploited, Cisco Confirms Active Exploitation of Multiple Flaws, China-Linked Fire Ant Hijacks Cisco Routers — The Hacker News