Loading vulnerability…
CVE-2026-20079 is an authentication-bypass vulnerability in the web-management interface of Cisco Secure Firewall Management Center (FMC) Software and affected Cisco Security Cloud Control Firewall Management deployments. An improperly created system process at boot time allows an unauthenticated remote attacker to send crafted HTTP requests, bypass authentication, and execute scripts or commands with root privileges on the underlying operating system. Exploitation can involve hijacking an unclaimed session associated with the boot-created process. Cisco confirmed active exploitation beginning in August 2026.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository is a standalone Python PoC for CVE-2026-20079 against Cisco Secure Firewall Management Center, not tied to a major exploit framework. The main exploit file is CVE-2026-20079.py; supporting documentation is in README.md and BLOG.md, and tests/test_poc.py provides a local mock FMC server and unit/integration-style tests. Core exploit chain implemented in the Python script matches the publicly documented sequence: reuse static session cookie 'csm_processes', POST to /login.cgi?logon=Continue with hardcoded machine credentials 'report'/'snortrules', GET /ui/user/general to scrape a 32-hex sf_action_id, POST to /sajaxintf.cgi?rs=callServerFunc to abuse validateLicense and write controlled content to /var/tmp/license.tmp, then POST to /pjb.cgi to invoke upgradeReadinessCall and execute the payload as root. Capabilities are broader than simple detection. The tool supports: fingerprint mode for likely FMC identification; check mode for auth-bypass validation; proof mode for root-execution verification via callback markers and collected identity/build output; and exploit mode for an interactive reverse shell using mkfifo, /bin/sh, and netcat. It also includes listener support, callback verification, cleanup tracking, target normalization, CIDR-based fingerprint input handling, and proxy/TLS options. The repository appears legitimate and operational: it contains substantial exploit logic, argument parsing, network handling, callback verification, and automated tests simulating the vulnerable endpoints. It is not merely a README or scanner. The exploit is operational rather than weaponized because it includes working payload delivery and callback handling, but remains a standalone PoC with explicit operator-supplied parameters rather than a reusable framework module.
This repository is a small standalone exploit PoC consisting of one Python script and one README. The main file, CVE-2026-20079.py, is the only code artifact and serves as the entry point. It uses the requests library to interact with a Cisco Secure Firewall Management Center (FMC) web interface over HTTPS, explicitly disabling certificate verification to accommodate self-signed deployments. The exploit logic is a two-stage chain. First, it creates a requests session and sends a POST request to /api/fmc_config/v1/upgradeSession with parameters action=session_upgrade and partial_session=1, attempting to abuse an alleged boot-time partial session condition to bypass authentication. If the response status indicates success (200/204/302), the script treats the target as compromised at the session level. Second, if the operator supplied a command, it sends another POST request to /cgi-bin/privilegedScriptHandler.cgi with script=exec, cmd=<command>, and elevate=root, attempting to execute arbitrary commands as root. The script also includes a --shell mode, but this does not automatically establish a shell; it only prints a suggested bash reverse-shell one-liner using /dev/tcp/YOUR_IP/4444. Capabilities: unauthenticated remote authentication bypass, session hijacking, arbitrary root command execution, and operator-guided reverse-shell follow-on. Attack surface: network/web against the FMC management interface. There is no persistence, lateral movement, or post-exploitation automation beyond command execution. Repository structure is minimal and purpose-built: README.md documents the claimed vulnerability, affected versions, impact, and references, while the Python script operationalizes the exploit chain. This is not part of a larger exploit framework such as Metasploit or Nuclei. Based on the code, it is an operational PoC rather than a detection script: it actively sends exploit requests and can execute attacker-provided commands. The payload is basic and hardcoded around two HTTP POST requests, so maturity is best classified as OPERATIONAL rather than weaponized.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
258 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously disclosed Cisco vulnerability in the same class as CVE-2026-20332 that has been exploited in the wild since August.
A critical Cisco Secure Firewall Management Center authentication-bypass vulnerability that permits unauthenticated remote attackers to obtain root privileges through crafted HTTP requests.
An exploited vulnerability in Cisco Secure Firewall Management Center, referenced as a separate recent Cisco exploitation event.
Vulnérabilité de Cisco Secure Firewall Management Center mentionnée comme contexte connexe; le contenu indique une exploitation par des acteurs malveillants mais ne fournit pas de détails techniques supplémentaires.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.