CISA Catalogued the Cisco Door and Left the Ladder - A CVSS 10.0 Root Bug With Two Public Exploits and No KEV Entry
- Patrick Duggan
- 3 hours ago
- 4 min read
At one minute past midnight our exploit harvester fired an alert. A second independent public proof-of-concept had appeared for CVE-2026-20079, a vulnerability in Cisco Secure Firewall Management Center.
We already had the first one, harvested ten days earlier. What made the second interesting was not the exploit. It was what happened when we checked whether CISA had catalogued the vulnerability.
It had not. It still has not.
Three vulnerabilities, one product, one very odd pattern
Cisco Secure Firewall Management Center is the console that administers your firewalls. Compromising it is not a lateral move to somewhere useful — it is somewhere useful. It is the thing that tells your perimeter what to allow.
Three FMC vulnerabilities are in play right now.
[CVE-2026-20316](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-20316) is a static-credential flaw. It scores 5.3 — medium. It hands an unauthenticated remote attacker a low-privilege account. It was exploited as a zero-day, Cisco published on 29 July, and CISA added it to the Known Exploited Vulnerabilities catalogue the same day with a three-day remediation deadline. That is the system working exactly as designed.
[CVE-2026-20131](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-20131) is also FMC, also in KEV, listed since 19 March.
[CVE-2026-20079](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-20079) sits between them. It is an authentication bypass that yields root on the appliance. Pre-authentication. Remote. Low complexity. Cisco scored it 10.0 — the maximum the scale allows. Cisco disclosed it in March and updated the advisory on 29 July.
It is not in KEV.
Why that combination is worse than either part
Cisco's own advisory for the static-credential bug contains this line: the access it grants "can be combined with other FMC vulnerabilities to elevate privileges."
CVE-2026-20079 is such a vulnerability. It is on the same product. It requires no authentication at all, so an attacker does not even need the foothold — but if they have one, it converts to root.
So the catalogue currently reflects this: the flaw that gets you in the door is listed and mandated. The flaw that gets you root is not.
A defender who patches strictly by KEV — which is a great many defenders, because KEV is the closest thing the industry has to an authoritative "fix this now" list, and it is written into federal remediation policy — closes the door and leaves the ladder propped against the wall beside it.
The receipts, and what they are not
We are not claiming to have found anything before Cisco. Cisco disclosed CVE-2026-20079 in March 2026. Anyone telling you they beat a vendor to their own advisory is usually counting the day they read it.
What we have is narrower and checkable: our exploit harvester recorded a public working exploit for it on 8 August 2026, and a second, independently authored one on 18 August 2026. Both timestamps are first-sight, not discovery. Both precede any KEV listing, because there still is not one.
The comparator here is the catalogue, not the vendor. That distinction is the whole reason the claim holds.
We also verified the KEV status against our own mirror rather than trusting a memory of it: 20316 present, added 29 July, due 1 August. 20131 present, added 19 March. 20079 — zero hits.
What KEV is, and what it is not
None of this is an attack on CISA. KEV does one job and does it well: it tells you what is being exploited in observed attacks. Its inclusion criterion is evidence of exploitation, not severity, and not exploit availability.
CVE-2026-20079 has not met that bar. Cisco states it is not aware of malicious exploitation. By KEV's own rules, its absence is correct.
The problem is not the catalogue. The problem is what defenders have quietly turned it into.
KEV was designed as a floor — the absolute minimum, the things definitely being used against people right now. Somewhere along the way a lot of organisations promoted it to a ceiling, and "is it in KEV?" became the whole patch-prioritisation conversation. When that happens, a CVSS 10.0 pre-auth root RCE with two working public exploits scores lower on your internal urgency scale than a 5.3 credential leak, because one has a federal deadline attached and the other has nothing.
That is a rational response to the incentives and a bad security outcome.
The gap worth watching
There is a window between "a working exploit is public" and "somebody is observed using it." KEV, by design, only opens at the far end of that window. Everything before it is your problem.
Two independent people have now published working code for a maximum-severity, pre-authentication root compromise of a firewall management console. That is not a prediction that it will be exploited. It is an observation that the cost of exploiting it has fallen to approximately zero, and the only thing standing between that and the KEV listing is somebody noticing and reporting it.
If you run on-premises Cisco Secure FMC, the useful question this week is not whether 20079 is on a government list. It is whether you have patched it.
What to do
Patch to the fixed FMC release. There is no workaround for 20079 — Cisco says so explicitly, and for an auth bypass in a boot-time process there would not be.
Then, more usefully: look at how your organisation actually prioritises. If a vulnerability needs a KEV entry before it gets a maintenance window, you have outsourced your risk decisions to a catalogue whose stated purpose is a minimum bar. Add "public exploit exists" as a trigger in its own right. It is a weaker signal than confirmed exploitation, and it arrives considerably earlier, which is the entire point.
We publish what our harvester finds. Confidence capped at 95 percent, as always — the exploits are real and dated, the KEV absence is verified, and what we cannot tell you is whether anyone is using them yet. Nobody can. That is the gap.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=cisa-catalogued-the-cisco-door-and-left-the-ladder-a-cvss-10-0-root-bug-with-two-public-exploits-a
Comments