A process created at boot lets one HTTP request take root on Cisco's firewall console

The root cause Cisco gives for CVE-2026-20079 is an improper system process created at boot, and a crafted HTTP request to an affected device executes scripts and commands as root ^[7]. That puts the defect before any administrator configuration. Cisco reported no workarounds ^[7], so on the box itself the March update was the only remedy. The classification is CWE-288, authentication bypass by alternate path ^[7].

Secure Firewall Management Center holds the policy, the configuration and often the credentials of the firewalls under it ^[5]. Administrators drive the fleet from one web or SSH interface, including intrusion prevention, application control and URL filtering policy ^[4]. The CVSS vector for the root flaw includes a scope change, reflecting that a compromise of the console directly affects the managed devices ^[5]. Someone with root there can rewrite firewall rules and suppress or alter security logging ^[6].

The second flaw is a hardcoded static credential for a low-privilege account, scored 5.3, and on its own it reads sensitive data ^[8]. Talos assesses with high confidence that UAT-11988 is a Qilin ransomware affiliate, and according to the write-up that cluster logged in with those static credentials, mapped the environment with living-off-the-land tooling, harvested credentials, deployed an AV killer and delivered Qilin ransomware ^[11]. A queue sorted by severity takes the 10.0 first and the 5.3 whenever it gets there.

UAT-12197 dropped a JSP web shell into the CSM Tomcat web root along with a malicious JAR command executor, then used the appliance's own OmniQuery.pl to extract authentication data from the FMC internal database ^[9]. UAT-11823, which Talos assesses with high confidence shares tooling with the Russian state-linked Sandworm actor, chained both flaws, rewrote license.tmp so an installer would run it as root, opened a Netcat reverse shell, collected the managed firewall configurations and deployed a Cyclops Blink variant capable of credential theft, command execution, file transfer and packet sniffing ^[10].

The six months in the write-up run from the March 2026 fix to the KEV listing on September 9 ^[3]. One published indicator is dated July 23, ahead of Cisco's stated August discovery ^[13]. Take the last day of March as the patch date and that indicator still lands 114 days later ^[16]; it also precedes the earliest day August can mean by nine ^[17].

The argument only transfers where the console answers from the internet. The write-up asserts that organizations count web servers and VPN gateways and count the consoles controlling their security devices far less often ^[14], and its text breaks off at the start of its internet-measurement section without a count of exposed FMC instances ^[18]. Three clusters with three different objectives reached the same device class ^[15]. Cisco published Snort SIDs for both vulnerabilities ^[12], which helps whoever is already inspecting traffic to their own management plane.