Cisco has released patches for two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) software that could allow unauthenticated remote attackers to gain root access. 

Critical Vulnerabilities (CVSS 10.0)

The two flaws are highly dangerous as they require no authentication and can be exploited remotely:

• CVE-2026-20079 (Authentication Bypass): This flaw allows an attacker to send crafted HTTP requests to an affected device. A successful exploit enables the attacker to bypass authentication and execute scripts or commands that provide root access to the underlying operating system.
• CVE-2026-20131 (Remote Code Execution):Attackers can exploit this by sending a crafted serialized Java object to the FMC’s web-based management interface. This allows for arbitrary code execution and privilege escalation to root. 

Impact & Affected Systems

Secure FMC is the central management hub for Cisco firewalls, controlling policies for intrusion prevention and malware protection. Compromising this system could lead to a complete takeover of an organization’s network security infrastructure. 

• Affected Product: Cisco Secure Firewall Management Center (formerly Firepower Management Center).
• Access Level: Both flaws lead to full root-levelprivileges. 

Mitigation & Recommendations

Cisco’s Product Security Incident Response Team (PSIRT) has not seen active exploitation in the wild yet, nor has public proof-of-concept code been released. However, immediate action is required: 

• Apply Patches: Cisco has released software updates to address these vulnerabilities. There are no known workarounds.
• Verify Versions: Administrators should check their Cisco Software Central account to download the fixed releases.
• Check Other Systems: This release was part of a larger update patching 25 other vulnerabilities across Cisco Secure Firewall, ASA, and FTD software.