Read-only Python checker that validates CVE-2026-20079 Cisco FMC authentication-bypass behavior by comparing unauthenticated and csm_processes session responses.
A small, deliberately limited validation utility for CVE-2026-20079, the Cisco Secure Firewall Management Center (FMC) authentication-bypass vulnerability.
This repository is a checker, not an exploit.
It does not contain the session-upgrade, file-write, command-execution, or RCE portions of the vulnerability chain.
The checker sends two HTTPS requests to /help/about.cgi:
CGISESSID=csm_processes.A finding is marked CONFIRMED only when the second response:
csm_processes session context.This provides a conservative, read-only way to validate the authentication-bypass behavior that we reproduced in a lab.
A negative result does not prove the appliance is patched.
The documented bypass requires the csm_processes session created at boot to
remain in the appliance's session database. Authenticated dashboard/widget
activity, cloud-managed UI activity, and authentication-triggered cleanup can
remove it. Once removed, this bypass cannot use that session; a subsequent boot
can recreate it on an affected appliance. This does not establish that every
successful login immediately disables the bypass. See
VulnCheck's prerequisite analysis.
Preferred state for controlled lab validation: test a recently rebooted appliance once its web interface is available, before any user authenticates or interacts with the web UI. This recommendation follows from the published session prerequisites: it increases the chance that the boot-created session still exists, but does not guarantee a positive result.
Distinguish the testing state from the result: a recently rebooted appliance offers a better opportunity to observe this behavior; a negative result after login or session cleanup does not establish that the appliance is patched. Even a negative result immediately after reboot is not proof of patch status.
For example, a user authenticates and UI activity clears the session. If the
checker then receives a redirect or HTTP 401/403, it reports NOT_CONFIRMED:
negative for the observed behavior, potentially a false negative for vulnerability
exposure. Authentication is not a patch.
The checker cannot observe login history or the session database. It classifies
the HTTP response, so prior authentication alone is not grounds to force a
negative result. Other unexpected responses remain INCONCLUSIVE, and request
failures remain ERROR.
Use Cisco's advisory and Software Checker to determine patch exposure.
The public version intentionally has no functionality for:
Only literal IP addresses supplied by the operator are accepted.
Public IPs require the explicit --allow-public flag.
requestsInstall:
python3 -m pip install -r requirements.txt
Private/lab IP:
python3 CVE-2026-20079-checker.py --host 192.168.1.100
Public IP that you are authorized to assess:
python3 CVE-2026-20079-checker.py \
--host 203.0.113.10 \
--allow-public
Create targets.txt:
# One literal IP address per line
192.168.1.100
192.168.1.101
Run:
python3 CVE-2026-20079-checker.py \
--targets targets.txt \
--json results.json \
--csv results.csv
For an authorized list containing public IPs:
python3 CVE-2026-20079-checker.py \
--targets targets.txt \
--allow-public \
--workers 4 \
--json results.json
The tool intentionally does not accept CIDR ranges.
Single-host scans show a detailed block. Example output using the documented
lab appliance (FMC 7.4.2 Build 172) and example target 192.168.1.100:
[*] CVE-2026-20079 Read-Only Validation
[*] Target : 192.168.1.100
[*] Endpoint : /help/about.cgi
[*] Mode : Read-only / no exploitation
[+] Appliance : Cisco Secure Firewall Management Center for KVM
[+] Version : 7.4.2
[+] Build : 172
[+] Server : Mojolicious (Perl)
[*] Baseline HTTP : 302
[*] Session HTTP : 200
[*] Session Context : csm_processes
[*] Comparison : baseline=302 -> probe=200
[CONFIRMED] CVE-2026-20079 authentication-bypass behavior observed
[*] Reason : Server returned FMC content with HTTP 200 while explicitly identifying the csm_processes session context.
[*] Summary:
confirmed=1
not_confirmed=0
inconclusive=0
errors=0
[!] Note : NOT_CONFIRMED does not prove the appliance is patched
Scans using --targets FILE show a compact table with TARGET, RESULT,
VERSION, BASE, and PROBE columns, followed by a summary. Missing details
appear as not observed in the detailed view or - in the table. Product and
session-context labels are informational; they do not change detection criteria.
JSON/CSV retain all existing fields and append product and session_context.
Neither a negative result nor missing metadata establishes patch status.
| Result | Meaning |
|---|---|
CONFIRMED | The observed response matches the read-only bypass indicator used by this checker. |
NOT_CONFIRMED | The probe returned a redirect or HTTP 401/403. The bypass was not observed; the required session may be absent. This is not equivalent to "patched." |
INCONCLUSIVE | FMC-like or otherwise unusual behavior was observed but the checker could not confirm the session identity. |
ERROR | Network/TLS/request failure prevented a determination. |
Exit codes:
0 — no confirmed finding1 — all checks failed with request errors2 — at least one confirmed finding64 — public target supplied without --allow-publicExit code 0 means no confirmed finding, including runs with inconclusive
results or a mixture of request errors and unconfirmed results. It is not a
patch-status verdict. Likewise, vulnerable_behavior: false in an export means
the confirmation criteria were not met.
During development, the read-only behavior was reproduced against:
Cisco Secure Firewall Management Center for KVM
7.4.2 Build 172
The purpose of documenting that observation is reproducibility; it is not a substitute for Cisco's authoritative vulnerable/fixed-release information.
See docs/LAB-NOTES.md.
Cisco rates CVE-2026-20079 Critical (CVSS 10.0) and states that successful exploitation can result in root access. Cisco has released fixes/hot fixes and reports active exploitation as of August 2026.
Follow Cisco's current advisory and Software Checker rather than relying on this scanner alone.
Run this utility only against systems you own or have explicit authorization to assess.
Network security testing can trigger monitoring controls, rate limits, incident response processes, or service-provider abuse systems even when the requests are read-only.
MIT. See LICENSE.