CISA Adds CVE-2026-20079 to KEV List for Cisco Firewall Management Vulnerability

## Overview CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) list on September 9, 2026. This vulnerability affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC). It allows unauthenticated remote attackers to bypass authentication and execute scripts on affected devices. ## Technical Details The vulnerability stems from an improper system process created at boot time. Attackers can exploit it by sending crafted HTTP requests. Successful exploitation grants root access to the underlying operating system. This poses a significant risk, as attackers can execute various scripts and commands. ## Impact With a CVSS score of 10.0, this vulnerability is critical. Exploitation can lead to full control of affected devices. Organizations using Cisco FMC and SCC are at high risk, especially if they have not applied recent updates. The potential for data breaches and unauthorized access is substantial, making immediate action essential. ## Mitigation Defenders should prioritize patching affected systems. Cisco has released updates to address this vulnerability. Organizations must ensure their firewall management systems are up to date. Regularly review security configurations and monitor for unusual activity. Implementing network segmentation can also help limit exposure.