CVE-2026-20079: Cisco's Other FMC Bug Scores a Perfect 10. Why Isn't It on the KEV List?

We wrote about CVE-2026-20316 two days ago: a hardcoded password in Cisco Secure Firewall Management Center, actively exploited, CISA deadline of August 1. That post mentioned Cisco had confirmed attackers were chaining the credential with “a second, separate FMC vulnerability” to escalate privileges. This is that vulnerability. CVE-2026-20079 scores a maximum 10.0 on CVSS, it lets an unauthenticated attacker get root, and it isn’t on the KEV catalog. If your patch queue used KEV membership as the filter for what’s urgent, that gap is worth closing today.

What the bug actually does

CVE-2026-20079 lives in the web interface of on-prem FMC. It’s classified as CWE-288, authentication bypass using an alternate path, which is a fancier way of saying there’s a way in that skips the front door entirely. The root cause is an improper system process created when the appliance boots. A remote attacker who sends the right crafted HTTP requests to that process doesn’t need a username, a password, or a session token. They land directly at a point where they can execute script files, and those scripts run as root on the underlying OS.

Root access on the box that manages every Secure Firewall appliance in your deployment is about as bad as a single vulnerability gets, which is exactly what the 10.0 score reflects. CVSS 10.0 is the ceiling of the scale. There isn’t a worse number to give it.

The timing quirk that actually matters

Here’s the detail that separates this from a bug that’s exploitable at any moment: the improper process only exists in the state attackers need for a window tied to a reboot. For the bypass to work, the FMC host has to have been rebooted recently enough that the relevant session is still present in the database. Once that window closes, the specific path this bug uses isn’t available until the next reboot.

That’s not a reason to relax. Production FMC appliances get rebooted routinely, for patching, for maintenance windows, for power events you don’t control. Every one of those reboots opens the window again on an unpatched box. Treating “exploitation requires specific timing” as “exploitation requires specific effort” is the wrong read; an attacker scanning for exposed FMC interfaces doesn’t need to guess your maintenance schedule, they just need to keep trying.

Why this isn’t on the KEV list, and why that’s not the same as “not urgent”

CISA’s Known Exploited Vulnerabilities catalog has one and only one bar for entry: confirmed evidence of active exploitation. It is not a severity ranking, and it was never meant to be one. CVE-2026-20316, the hardcoded password bug, made the KEV list on July 29 because Cisco confirmed real attacks using it. CVE-2026-20079 has not, as of this writing, been reported by Cisco as actively exploited, so it stays off the list on the same criteria.

That’s a meaningful distinction for triage, but it’s easy to over-read it. A missing KEV entry tells you “we don’t have confirmed evidence yet.” It doesn’t tell you “this is safe to defer.” CVE-2026-20079 was originally disclosed back in March 2026, and Cisco’s decision to update the advisory on July 29, tying it to the actively-exploited credential bug, is itself a signal: the two flaws share a fix cycle and, per Cisco’s own advisory, a documented escalation path. Treating the KEV list as your only patch-priority filter would leave a 10.0 unauthenticated root exploit sitting in the backlog next to a routine bug fix, and those are not the same category of risk.

Who’s affected and what fixes it

The affected releases line up with what we covered for CVE-2026-20316, because Cisco’s July 29 update bundled the two advisories:

Release train	Status
7.0	Hotfix available
7.2	Hotfix available
7.4	Hotfix available
7.6	Hotfix available
7.7	Hotfix available
10.0	Hotfix available

Cloud-delivered FMC and Cisco Defense Orchestrator are not implicated, consistent with the earlier advisory. If you run FMC on your own hardware or virtual environment, you’re in scope until the hotfix is applied.

# If you already patched for CVE-2026-20316 this week, confirm the same
# hotfix build also lists CVE-2026-20079 as resolved for your release train.
# Cisco's advisory covers both CVEs under one set of fixed releases as of
# the July 29 update. Don't assume a partial patch from before that date
# covers this bug.

What to check today

If you handled CVE-2026-20316 already, don’t close the ticket yet. Pull up Cisco’s current advisory and confirm the hotfix build you applied is dated on or after July 29, since that’s when the two CVEs were formally linked under one fixed-release table. If you’re running a build from before that date, you may have closed the credential hole while leaving the root-level auth bypass open next to it.

If you manage FMC for clients through a cybersecurity engagement, this is a good prompt to re-run your inventory check rather than trusting the first pass. A KEV-only patch policy would have caught CVE-2026-20316 and missed this one, and the two live in the same advisory for a reason.

The honest takeaway is that CVSS and KEV measure different things, and neither one alone tells you what to patch first. CVSS 10.0 says “this is as bad as it gets if exploited.” KEV says “we’ve confirmed someone is exploiting it.” A vulnerability can be true on the first and not yet true on the second, and CVE-2026-20079 is sitting in exactly that gap right now. Patch it like the first sentence matters, not just the second.