Detect Cisco Secure FMC Authentication Bypass via Alternate Path (CVE-2026-20079) in IBM QRadar
Detects exploitation of CVE-2026-20079, a KEV-listed authentication bypass (CWE-288) in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management. An unauthenticated remote attacker can reach protected FMC administrative functions using an alternate path or channel, bypassing authentication. Detection focuses on anomalous access to FMC administrative/API endpoints, authentication events that succeed without a corresponding credential validation, and post-exploitation activity such as new admin users, policy changes, and configuration exports observed in FMC syslog/audit and web-server telemetry.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, destinationip, "URL", "Message", COUNT(*) AS request_count, MIN(startTime) AS first_seen, MAX(startTime) AS last_seen FROM events WHERE (LOGSOURCETYPENAME(devicetype) ILIKE '%Cisco%' AND ("Message" ILIKE '%/api/fmc_platform/%' OR "Message" ILIKE '%/admin%' OR "Message" ILIKE '%/ui/login%' OR "URL" ILIKE '%/api/fmc%')) AND "Message" ILIKE '%auth%' GROUP BY sourceip, destinationip, "URL", "Message" HAVING COUNT(*) > 1 ORDER BY request_count DESC LAST 24 HOURSAggregates Cisco FMC administrative endpoint access with authentication context in QRadar to identify unauthenticated alternate-path access consistent with CVE-2026-20079.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate admin sessions from trusted management hosts
- API automation accounts
- Security scanners
Other platforms for CVE-2026-20079
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated FMC API platform request
Expected signal: FMC web-server/access log entry for /api/fmc_platform/ from the test source IP without a valid session token.
- Test 2Simulate FMC login page probe from external source
Expected signal: Multiple /ui/login access-log entries from a single source IP within a short window.
- Test 3Simulate post-exploitation admin user creation event
Expected signal: Syslog record on the FMC log collector showing new-user creation with no valid session.
References (5)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
- https://nvd.nist.gov/vuln/detail/CVE-2026-20079
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/
Response Playbook
Triage
- Confirm the affected system is a Cisco Secure FMC or SCC Firewall Management instance and check its version against Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2 to determine if it is a vulnerable, unpatched release.
- Review the source IP(s) of the flagged FMC admin/API access — determine whether they belong to the authorized management network/VPN or are external/unexpected.
- Correlate the alert with FMC audit logs: identify whether any privileged action (login, user creation, policy change) occurred without a preceding valid authentication event.
- Check whether the FMC management interface is reachable from untrusted networks, which materially raises exploitation likelihood.
Containment
- Restrict FMC/SCC management interface access to a trusted management network or jump host via ACLs and, if exposed, immediately remove it from internet-facing reachability.
- Apply the Cisco fixed software release identified in advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2; there are no workarounds for this authentication bypass.
- Force-rotate all FMC administrator credentials and API tokens, and invalidate active sessions if compromise is suspected.
Evidence Collection
- Preserve FMC audit/syslog, web-server access logs, and eStreamer records covering the suspected exploitation window before any remediation reboot.
- Export the current FMC user list, API token inventory, and access-control/policy configuration to compare against a known-good baseline for unauthorized changes.
Escalation Criteria
- !Escalate to incident response if a new administrator account, altered access-control policy, or configuration export is observed without a corresponding authenticated admin session.
- !Escalate immediately if the FMC management interface was internet-reachable and any successful privileged access from an untrusted source is confirmed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
FMC audit log entries showing privileged actions with no or anomalous authentication method - >
Web-server/access logs for /api/fmc_platform, /api/fmc_config, /ui/login and /admin paths - >
New or modified administrator accounts and API tokens in the FMC user store - >
Changes to access-control policies, NAT rules, or configuration exports timestamped to the incident window
Tuning Guidance
Baseline the set of source IPs and service accounts that legitimately access the FMC management interface and REST API, then exclude them from the primary detection. Because Cisco appliance log field names vary by ingestion path (CEF, native syslog, eStreamer, vendor DSM), validate the URL/message field mappings against your environment and adjust the path and authentication keyword lists. Prioritize alerts where the source is outside the management network or where authentication context is absent, and lower noise from health checks by requiring more than one admin/API request per source.
Hunting Queries
Hunts for post-exploitation administrative changes on FMC — new users, policy edits, and configuration exports — that would follow a successful authentication bypass.
CommonSecurityLog | where DeviceProduct has_any ("FMC","Firepower","Secure Firewall") | where Message has_any ("user created","admin added","policy modified","config export") | project TimeGenerated, SourceIP, DeviceName, Message | order by TimeGenerated descindex=network (sourcetype=cisco:fmc OR sourcetype=cisco:firepower) ("user created" OR "admin added" OR "policy modified" OR "config export") | stats count by src, dest, _raw | sort - countAtomic Red Team Tests
Sends an unauthenticated HTTP request to the FMC platform API endpoint to generate access-log telemetry matching the detection (lab/authorized target only).
Command
curl -k -s -o /dev/null -w '%{http_code}\n' https://fmc.lab.local/api/fmc_platform/v1/info/serverversionCleanup
echo 'No cleanup required; read-only request against lab FMC.'Expected Telemetry
FMC web-server/access log entry for /api/fmc_platform/ from the test source IP without a valid session token.
Expected Detection
KQL/SPL rule flags admin/API endpoint access accompanied by authentication context from an unexpected source.
Requests the FMC UI login endpoint repeatedly to emulate reconnaissance of the management interface.
Command
for i in $(seq 1 3); do curl -k -s -o /dev/null https://fmc.lab.local/ui/login; doneCleanup
echo 'No cleanup required; read-only requests.'Expected Telemetry
Multiple /ui/login access-log entries from a single source IP within a short window.
Expected Detection
Detection aggregates repeated admin/login endpoint access per source and raises an alert.
Writes a synthetic FMC audit log entry representing creation of a new administrator account for detection-content validation (lab log pipeline only).
Command
logger -p local4.info -t cisco-fmc 'AUDIT: user admin_bak created by 203.0.113.50 via /api/fmc_config/v1/domain/default/users session=none'Cleanup
echo 'Remove synthetic test log entry from the lab collector if retention policy requires.'Expected Telemetry
Syslog record on the FMC log collector showing new-user creation with no valid session.
Expected Detection
Hunting query for post-exploitation admin changes matches the synthetic user-creation event.