ZDI-26-533: Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability
ZDI discloses CVE-2026-20316, a 9.8-rated unauthenticated authentication bypass in Cisco Secure Firewall Management Center login.cgi.
ZDI-26-533 describes an authentication bypass vulnerability in Cisco Secure Firewall Management Center's login.cgi that allows remote attackers to bypass authentication without any credentials. ZDI assigned a CVSS score of 9.8, and the flaw is tracked as CVE-2026-20316. As a central management plane for firewall infrastructure, compromise could enable broad policy changes.
- Authentication bypass in Cisco Secure Firewall Management Center login.cgi
- No authentication required, remote exploitable
- CVSS 9.8, tracked as CVE-2026-20316
- Affects central management of security infrastructure
- CVEs
- CVE-2026-20316
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
From the original article
This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.