Cisco Secure Firewall Management Center authentication bypass enables root access

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.

• Cisco Secure Firewall Management Center (FMC) Software is affected according to Cisco's advisory, which describes the scope as independent of device configuration. The normalized record marks these exact releases as affected: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3, 7.0.4, 7.0.5, 7.1.0, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.2.0, 7.2.0.1, 7.2.1, 7.2.2, 7.2.3, 7.3.0, and 7.3.1.
• Cisco's current advisory documents the 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0, and 10.1 release branches, with first fixed releases of 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0, respectively.
• Cisco Security Cloud Control (SCC) Firewall Management is a SaaS-delivered offering upgraded by Cisco during maintenance. Cisco states that the fix has been deployed and no user action is required.
• Cisco confirmed that Firewall Device Manager (FDM), Secure Firewall Adaptive Security Appliance (ASA) Software, Secure Firewall Threat Defense (FTD) Software, and Security Cloud Control (SCC), formerly Defense Orchestrator, are not affected. Security Cloud Control formerly Defense Orchestrator should not be confused with SCC Firewall Management SaaS.
• The current advisory does not establish a first fixed release for every exact release in the normalized record, especially branches not represented in its current fixed-release table. Later or parallel releases not listed should not be assumed unaffected.

The flaw is in the web interface of Cisco Secure Firewall Management Center (FMC) Software and is classified as Authentication Bypass Using an Alternate Path or Channel. Cisco attributes it to an improper system process created when the device boots. An unauthenticated attacker who can reach the device over the network can send crafted HTTP requests, bypass authentication, and execute scripts and commands on the underlying operating system with root privileges. The public advisory does not identify the process name, HTTP endpoint, request format, or precise validation defect. Cisco states that the attack surface is reduced when the FMC management interface is not publicly accessible, but that is not a fix.

The vulnerability is remotely reachable through the web interface using crafted HTTP requests. The CVE record and Cisco advisory describe exploitation as requiring no credentials, no user interaction, and no complex precondition beyond network reachability. Cisco PSIRT stated that it became aware of active exploitation in August 2026, and Cisco Talos is tracking exploitation of unpatched FMC instances. A public PoC and technical write-up have also been published, confirming public exploit availability. Removing public exposure reduces the attack surface but does not establish that a device is safe.

The technical outcome is an authentication bypass on the web interface followed by script and command execution with root privileges on the underlying operating system. This crosses the FMC access-control boundary and could let an attacker change system state, access sensitive data, or disrupt management services. The realized impact depends on network reachability, the data and control held by the device, and the organization's segmentation and monitoring controls. If the device was compromised, upgrading alone is not sufficient evidence that attacker changes or persistence have been removed.

Successful exploitation can give an attacker root access to the firewall management device. That access could allow the attacker to read or alter data and configuration, execute arbitrary commands, disrupt management operations, or use the FMC as a foothold for further activity in the environment. Because the result reaches the underlying operating system, confidentiality, integrity, and availability of the device may all be affected. This entry does not establish that a particular organization was breached or that specific data was exfiltrated.

1. Upgrade Cisco Secure FMC Software to the appropriate Cisco hardening release: 7.0 and earlier to 7.0.10, 7.2 to 7.2.12, 7.4 to 7.4.8, 7.6 to 7.6.6, 7.7 to 7.7.13, 10.0 to 10.0.2, or 10.1 to 10.1.0. These are the first fixed releases documented in Cisco's current advisory and should not be treated as an open-ended assertion that every later or parallel release is safe.
2. For a release that does not map clearly to the table above, use Cisco Software Checker or contact Cisco TAC to determine the exact first fixed release. This is especially important for affected releases listed in the normalized record that do not have a corresponding branch in the current table.
3. Do not rely on a workaround to resolve the vulnerability. Cisco states that no workaround addresses it. Removing public Internet access from the FMC management interface, where operationally feasible, can reduce exposure but does not replace upgrading.
4. If an IOC is found or compromise is suspected, contact Cisco TAC immediately for recovery guidance. Preventing new exploitation does not necessarily remove an existing compromise.
5. For Cisco SCC Firewall Management SaaS, Cisco states that the fix has already been deployed and no user action is required. Organizations should still verify service status through their normal management process.

1. Inventory all Cisco Secure FMC Software deployments and identify the exact release on each device, including centrally managed systems and relevant SaaS environments.
2. In expert mode, inspect logs with zgrep "package_info.*license" /var/log/messages*. If the output contains a reference to /var/tmp/license.tmp, Cisco identifies that as an indication that the device may have been exploited.
3. Use Snort rules 66075-66080 where supported to detect related traffic. The absence of a matching rule or log entry does not prove that exploitation did not occur.
4. Review management-interface access logs and administrative activity for unexpected behavior as an additional precaution, not as a confirmed Cisco IOC.
5. If an indicator is found, contact the Cisco Technical Assistance Center (TAC) for recovery guidance. Hot fixes may prevent additional exploitation but may not remediate an existing compromise.