Cisco Confirms Active Exploitation of Critical Secure FMC Flaw
Summary
Cisco says unauthenticated attackers are exploiting CVE-2026-20079 to run commands as root on vulnerable Secure FMC systems. Cisco and CISA urge patching; hot fixes prevent future attacks but do not clean compromised devices.
Key points
- CVE-2026-20079 is a maximum-severity authentication bypass in Cisco Secure Firewall Management Center, rated CVSS 10.0.
- Crafted HTTP requests can let unauthenticated remote attackers execute scripts and commands with root privileges.
- Cisco confirmed active exploitation but did not disclose when attacks began, who was responsible, or what activity followed access.
- The flaw affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management; Cisco says it has patched the cloud-hosted service.
- Cisco recommends upgrading and says there are no workarounds. Hot fixes prevent future exploitation but do not remediate systems already compromised.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a September 12, 2026 deadline for federal civilian agencies to secure affected systems.
- Shared indicators and July hot fixes suggest CVE-2026-20079 may have been exploited alongside CVE-2026-20316, but Cisco has not clarified whether both were used in the July activity.
Article Details
- Vulnerability Types
- Authentication bypass
- Static credentials for a low-privileged account
- Severity
- Maximum severity; CVE-2026-20079 has a CVSS score of 10.0. CVE-2026-20316 is rated High.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSuccessful exploitation of CVE-2026-20079 allows attackers to execute scripts and commands as root on vulnerable devices.T1190 · Exploit Public-Facing ApplicationUnauthenticated attackers exploit CVE-2026-20079 by sending crafted HTTP requests to the affected device's web interface.
CVE
CVE-2026-20079Cisco has confirmed that CVE-2026-20079, a maximum-severity authentication bypass flaw in Secure Firewall Management Center, is being actively exploited and can let unauthenticated attackers gain root-level accessCVE-2026-20316Cloud Control Firewall Management, with evidence suggesting it may have been exploited alongside CVE-2026-20316.
Vendors
Products
Cisco Secure FMC SoftwareThe company and CISA urge immediate patching, as the vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management, with evidence suggesting it may have been exploited alongsideCisco Security Cloud Control Firewall Managementurge immediate patching, as the vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management, with evidence suggesting it may have been exploited alongside CVE-2026-20316.