CVE-2026-20079 - Cisco FMC Authentication Bypass RCE Analysis

What it is

VulnCheck's exploit-development analysis of CVE-2026-20079, a CVSS 10.0 unauthenticated auth-bypass-to-root-RCE in Cisco Secure Firewall Management Center (FMC). Cisco published the advisory March 4, 2026. Censys sees ~300 exposed FMC instances; FOFA sees 600–700. VulnCheck reversed the patch (a ~25-line change to Apache's httpsd_conf.tt template and SF/Auth.pm) and built a working exploit.

How it works

At boot, the Go binary auth-daemon creates a session for the machine account csm_processes in the sfsnort.sessions table — but with a static session ID (csm_processes) instead of a dynamic UUID. An attacker sets CGISESSID=csm_processes and is treated as that machine user. The user has no permissions and no sf_action_id (CSRF token), so most CGI/API calls fail. The upgrade:

1. Log in via login.cgi using the hardcoded credentials report:snortrules while carrying the CGISESSID=csm_processes cookie. Auth upgrades the existing boot session to a UI (usertype=1) session and populates sf_action_id. (Using csm_processes's own creds csmdaemon instead expires the session and locks you out — a different machine account is required.)
2. Extract the sf_action_id from the rendered /ui/user/general page.
3. Arbitrary file write via sajaxintf.cgi's validateLicense call (all-user permission), writing JSON-Unicode-escaped bytes (\u000A for newlines) to /var/tmp/license.tmp. Payload is a shell script in Cisco "Makeself" format (must contain # This script was generated using Makeself).
4. Trigger pjb.cgi → SF::UI::DataObjectLibrary::upgradeReadinessCall pointing at license.tmp; the installer path runs it through SF::System::Wrappers::RunCmd, which prepends sudo — executing the script as root.

flowchart TD
    A[Set CGISESSID=csm_processes<br/>boot session] --> B[login.cgi as report:snortrules<br/>upgrades session to UI]
    B --> C[Extract sf_action_id]
    C --> D[validateLicense write<br/>Makeself script to license.tmp]
    D --> E[upgradeReadinessCall<br/>installer runs it as root]
    A -. session cleared by UI activity .-x X[No exploit]

Preconditions / Affected

• Cisco Secure Firewall Management Center; patched code seen under path version 7.7.12-3.
• The host must have been rebooted and the injected boot session must still exist. The session is cleared by: authenticated dashboard/widget interaction, cloud-managed UI sessions, or periodic cleanups on account auth. Practically, targets are exploitable only shortly after boot or on systems no one logs into via the web UI.

What to do

Patch. The fix adds an Apache rule setting X-Auth-User-Type 1 for all non-localhost requests, and Auth.pm rejects any request whose session usertype (e.g. AUTH_IS_MACHINE=2) doesn't match the header — blocking web use of machine sessions. Restrict FMC web-interface exposure to the internet in the interim. VulnCheck offers an exploit, PCAPs, a YARA rule, and network signatures for five variants to Initial Access Intelligence customers — useful for detection sourcing.

Caveats

VulnCheck also found a path-traversal + Storable::retrieve deserialization sink (batchResults in SF/Util.pm, with unsafe $Storable::Eval=1) reachable via the same file write. They generated CODE-serialized data and reached STORABLE_thaw but found no working gadget to RCE before the installer path succeeded; they note a "Perl wizard" may find one.