Cisco Confirms Active Exploitation of Critical Secure FMC Vulnerability

Cisco has confirmed that a maximum-severity authentication bypass vulnerability in its Secure Firewall Management Center (FMC) software is being actively exploited. The flaw, tracked as CVE-2026-20079, has been assigned a CVSS score of 10.0, the highest possible severity rating.

The vulnerability allows unauthenticated, remote attackers to bypass authentication and execute scripts or commands with root privileges on vulnerable devices. The issue is caused by an improper system process created during the boot sequence, which can be exploited by sending crafted HTTP requests to the device’s web interface. Cisco originally disclosed the vulnerability in March 2026, noting at the time that there was no evidence of active exploitation.

CISA Adds Flaw to Exploited Vulnerabilities Catalogue

Following confirmation of the attacks, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalogue. CISA has ordered Federal Civilian Executive Branch agencies to secure their affected systems by 12 September 2026.

Although Cisco’s security team became aware of the exploitation in August 2026, technical indicators suggest the flaw may have been targeted as early as July. The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management.

Patching and Compromise Detection

Cisco has already patched its cloud-hosted Security Cloud Control service. However, for other affected products, the company recommends that customers upgrade to the latest software release immediately, as no workarounds are available.

Administrators are warned that while patching prevents future exploitation, it will not remediate devices that have already been compromised. Cisco advises users to check /var/log/messages for any activity related to /var/tmp/license.tmp. If these indicators are found, the device may have been exploited, and organisations should contact the Cisco Technical Assistance Center (TAC) for support.