Overview
- Cisco has confirmed that CVE-2026-20079, a maximum-severity (CVSS 10.0) authentication-bypass in Secure Firewall Management Center (FMC), is being actively exploited and can let unauthenticated attackers execute commands as root.
- The bug stems from an improper system process created at boot and is reached by sending crafted HTTP requests to the FMC web interface, which allows attackers to bypass authentication and run scripts on the device.
- Cisco published hot fixes for the on-premises FMC software and says it has patched the cloud-hosted Security Cloud Control service, but it warns that installing updates will not remove attacker access on already-compromised systems and directs affected customers to contact Cisco TAC for incident support.
- The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
- Published indicators of compromise and vendor intelligence link activity dating to July with attacks that used the FMC flaws to deploy web shells, credential theft tools, Cyclops Blink malware and ransomware access, which raises the risk of broad firewall takeover and downstream network compromise.