Overview
- Cisco confirmed late Wednesday that CVE-2026-20079, a maximum-severity authentication bypass in Secure Firewall Management Center, is being actively exploited in the wild.
- The flaw lets an unauthenticated remote attacker send crafted HTTP requests to the FMC web interface to run scripts and commands as root by abusing a system process created at boot.
- Attackers have chained CVE-2026-20079 with a separate static-credential flaw, CVE-2026-20316, to move from low‑privilege access to full control and place web shells, reverse shells, and malware.
- Cisco Talos links three intrusion clusters to these flaws, including activity attributed to Sandworm that deployed Cyclops Blink and cluster activity tied to Qilin ransomware affiliates that staged credential theft and encryption operations.
- Federal and vendor actions are under way: CISA added CVE-2026-20079 to its KEV list with a Sept. 12 remediation order for federal agencies, Cisco published hotfixes and a hardening release next week, and defenders are urged to hunt logs (for example the /var/tmp/license.tmp entry), isolate exposed FMC interfaces, and assume forensic response is needed because fixes do not remove implants.