Our automated tracking framework flagged that CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management) to the Known Exploited Vulnerabilities (KEV) catalog on September 13, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-20079 by September 12, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-20079 |
| Vendor / product | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management |
| Vulnerability | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability |
| CVSS base score | 10 |
| Added to KEV | September 9, 2026 |
| Days public before listing (NVD → KEV lag) | 189 |
| Federal patch deadline | September 12, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was public for just 189 days before CISA confirmed exploitation — faster than Cisco’s 1244-day median, meaning attackers moved unusually quickly. Cisco currently ranks #8 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 97 |
| Median lag (public → KEV listing) | 1244 days |
| 0-day rate (exploited at or before disclosure) | 14% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1709 tracked KEV entries is 252 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | August 11, 2026 | 0 | No |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
| CVE-2008-4128 | IOS | July 13, 2026 | 6507 | No |
| CVE-2026-20230 | Unified Communications Manager | June 25, 2026 | 22 | No |
| CVE-2026-20262 | Catalyst SD-WAN Manager | June 15, 2026 | 0 | No |
What This Means for Defenders
CISA has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog. This authentication bypass in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management has a CVSS base score of 10. Federal agencies must patch by September 12, 2026, just three days after its KEV listing on September 9, 2026. Organizations managing Cisco firewall infrastructure are directly exposed and should prioritize patching to prevent unauthorized access to network management systems.
This vulnerability was public for 189 days before its KEV listing. While ransomware use isn’t currently known, the high CVSS score signals severe potential impact. The rapid KEV listing suggests it escalated to active exploitation quickly, urging affected organizations to act swiftly.
If immediate patching isn’t feasible before the September 12 deadline, security teams must implement compensating controls. Restrict network access to management interfaces, implement strong multi-factor authentication for all administrative accounts, and enhance monitoring for unusual activity on FMC and SCC instances. Swift action is paramount to mitigate the risk from this critical vulnerability.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
