Cisco Confirms Exploitation of Critical Secure FMC Vulnerability

Cisco has confirmed that a maximum-severity vulnerability in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks. The flaw, assigned the identifier CVE-2026-20079, has been rated 10.0 out of a possible 10 on the CVSS scale.

What the vulnerability is about

The issue stems from a system process that is created incorrectly at boot time. By sending specially crafted HTTP requests to the web interface of a vulnerable device, a remote, unauthenticated attacker can bypass authentication and execute arbitrary scripts and commands with root privileges.

The vulnerability affects Cisco Secure FMC software and the cloud-based Cisco Security Cloud Control Firewall Management service. The company has already patched the cloud component. There are no workarounds — Cisco recommends installing the latest version of the software. That said, applying the fixes only prevents future attacks; it does not restore devices that have already been compromised.

A timeline of omissions

CVE-2026-20079 first came to light in March, when Cisco said there were no signs of it being used. In a bulletin updated this week, the company reported that its PSIRT team learned of actual exploitation in August 2026. Cisco has not disclosed who is behind the attacks, exactly when they began, or what the attackers did after gaining access.

Indirect evidence, however, points to an earlier start. On July 29, Cisco disclosed another Secure FMC vulnerability — CVE-2026-20316, involving static credentials for a low-privilege account — and acknowledged that it was being exploited. At the same time, the company added the same indicators of compromise to the CVE-2026-20079 bulletin, but did not confirm that attacks had taken place. Administrators were advised to look in /var/log/messages for activity around the file /var/tmp/license.tmp; the sample entry Cisco provided is dated July 23 — weeks before August, when, according to the company, PSIRT learned of the attacks.

Identical indicators, the same July emergency fixes for both vulnerabilities, and the same log entry suggest that both flaws were used in the same attacks, and that low-privilege access via static credentials may have been combined with the authentication bypass to escalate privileges. Cisco declined to answer BleepingComputer's direct questions about a link between the two vulnerabilities, limiting itself to urging customers to install the fixes immediately.

The U.S. agency CISA has added CVE-2026-20079 to its catalog of known exploited vulnerabilities, ordering federal civilian agencies to remediate the flaw by September 12, 2026.

Source: Bleeping Computer