Reported by 23 outlets
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities Indicators extracted from public reporting. Source: https://
Why this score
- Breadth
- 2.00 / 2.0 · 23 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-20079 is a CVSS 10.0 authentication bypass (CWE-288) in the web interface of on-premises Cisco Secure Firewall Management Center, and Cisco confirmed on September 9, 2026 that it is being actively exploited, with CISA listing it in the KEV catalog the same day and a September 12 patch deadline. The mechanism is a boot-time artifact: FMC creates a partial session for its csm_processes machine identity, an attacker upgrades that session at /login.cgi?logon=Continue using the hardcoded report:snortrules machine credential, pulls the session's sf_action_id from /ui/user/general, writes a Makeself-formatted script to /var/tmp/license.tmp through validateLicense, and lets the privileged update path run it as root. Public reproduction against FMC 10.0.1-1 produced a uid=0(root) shell. There is no workaround for on-prem FMC; Cisco has already patched its cloud-hosted SCC Firewall Management.
Root on the FMC is not one more compromised server, it is the management plane that pushes policy to every managed Firepower device, so an attacker can rewrite inspection rules, suppress logging, and stage from a console the SOC partly trusts. The public reproduction also showed the follow-on: reading /etc/vault/token on the appliance exposed a local Vault client token at 127.0.0.1:8200 that yielded a working LDAP service credential and a successful directory bind, a concrete path from firewall root to lateral movement. The weight of this story is the timeline rather than the score. Cisco published the advisory on March 4, 2026 saying it had no evidence of exploitation, added indicators of compromise and hotfixes in the July 31 revision, public exploit code was live by August 15, and confirmation of attacks came in September. Organizations that deferred the March patch on an internet-reachable management interface spent about six months exposed to a bug that requires no credentials. Talos is tracking two exploited FMC vulnerabilities, CVE-2026-20131 in the same product has been KEV-listed since March 19, 2026, and current reporting ties the intrusions to credential theft and Qilin ransomware deployment, so an unpatched FMC now sits directly on the ransomware precursor path.
Remediation means the first fixed releases: 7.0.10 on the 7.0 train, then 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0, which supersede the earlier hotfixes. Restrict FMC management to dedicated administrative networks or jump hosts since the advisory notes that public internet exposure enlarges the attack surface, and deploy Snort rules 66075 through 66080. The hunt starts with Cisco's own check, run in expert mode: zgrep "package_info.license" messages, where any output naming /var/tmp/license.tmp, such as a www-user line invoking /usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm, should be treated as compromise and escalated to Cisco TAC. In web logs, look for POSTs to /login.cgi?logon=Continue carrying CGISESSID=csm_processes and the report username, immediate access to /ui/user/general, validateLicense calls to /sajaxintf.cgi?rs=callServerFunc, upgradeReadinessCall traffic to /pjb.cgi, FIFO files under /tmp alongside netcat, and root reads of /etc/vault/token. Any hit means rotating FMC-stored integration credentials, revoking sessions and tokens, and rebuilding from a trusted image.
Two developments would move the assessment. Talos has not yet named the actor or detailed how the second exploited FMC vulnerability fits the chain, and that detail would tell defenders whether this is targeted access or a commoditized ransomware precursor. Broad scanning of internet-exposed FMC management ports would be the other shift: with credential-free exploitation and public code available since mid-August, such telemetry would turn this from incident response on suspected victims into assume-breach triage for every unpatched appliance.
Timeline
-
update from cisco.com
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
cisco.com · 223d ago · March 4th, 2026
Cisco's advisory for CVE-2026-20079 (CVSS 10.0, CWE-288, no workarounds) was first published March 4, 2026 as part of the March 2026 Secure Firewall bundled publication and credits Brandon Sakai of Cisco internal security testing. A July 31, 2026 revision added bug ID CSCwt95974, indicators of compromise, and hotfixes, and revision 2.5 states the Cisco PSIRT became aware of active exploitation in August 2026. First fixed releases are 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0, with Snort rules 66075-66080 referenced for detection.
-
update from sec.cloudapps.cisco.com
Cisco Security Advisory cisco-sa-fmc-static-cred-BET3Cjh - CVE-2026-20316
sec.cloudapps.cisco.com · 76d ago · July 29th, 2026
Cisco published the advisory for CVE-2026-20316 (CVSS 5.3, CWE-259 hardcoded static credentials) on July 29, 2026. The vulnerability allows an unauthenticated remote attacker to log in using a low-privileged account and access sensitive data within FMC software. The advisory notes no workarounds exist and lists the same fixed releases as the authentication bypass advisory, emphasizing the vulnerability can be chained for privilege elevation.
-
update from bleepingcomputer.com
Cisco Secure FMC Zero-Day (CVE-2026-20316) Added to CISA KEV — Active Exploitation
bleepingcomputer.com · 76d ago · July 30th, 2026
Previously covered Jul 29 (initial disclosure). New today: CISA added to KEV with a 3-day remediation deadline, Hotfix now available across all affected release trains.
CVE-2026-20316 — a high-severity (CVSS 5.3, rated High by Cisco) static credential vulnerability in Cisco Secure Firewall Management Center — has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of July 29. Federal agencies have until August 1, 2026 to remediate under BOD 26-04. Key details:
-
Static credentials for a low-privilege account are hardcoded into FMC software affecting releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0
-
No workarounds available — patch or isolate
-
The low-privilege access can be chained with other FMC vulnerabilities (not yet identified by Cisco) to escalate privileges
-
CISA's KEV entry confirms this is being actively used in attacks
-
Attack surface reduced when FMC management interface is not internet-exposed, but CISA's KEV inclusion signals widespread scanning/pre-positioning
-
Reported by Jimi Sebree of Horizon3.ai
Cisco FMC attack chain implications: This follows the Jul 27 addition of Arista VeloCloud CVE-2026-16812 (CVSS 10) to KEV — two major network management appliances have had exploited zero-days added to CISA's catalog within one week. Action: Install hotfixes available from Cisco for each affected release train. Audit
/var/log/messagesfor signs of prior exploitation. -
-
update from banks.tools
From Advisory to Root: Reproducing CVE-2026-20079 on Cisco Secure FMC
banks.tools · 60d ago · August 15th, 2026
Arian Eidizadeh published this write-up on August 15, 2026, reproducing the public authentication-bypass chain on Cisco Secure FMC 10.0.1-1 and confirming uid=0(root) execution. It documents reuse of the boot-created csm_processes session, the report:snortrules machine credential, the /var/tmp/license.tmp write via validateLicense, and a post-exploitation path that read /etc/vault/token on the appliance to recover a working LDAP service credential from a local Vault.
-
update from seclists.org
CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE
seclists.org · 54d ago · August 20th, 2026
A Full Disclosure mailing list post dated August 20, 2026 announced a public Python PoC by Arian Eidizadeh (CyberAuth) that independently reproduced the CVE-2026-20079 chain against Cisco Secure FMC 10.0.1-1 with confirmed root execution. The post links the GitHub PoC repository and the banks.tools technical write-up, and explicitly does not claim discovery of the vulnerability or the original exploit chain.
-
update from cisa.gov
CISA Adds CVE-2026-20079 to Known Exploited Vulnerabilities Catalog
cisa.gov · 35d ago · September 9th, 2026
The alert notes the vulnerability allows malicious actors to gain total control of affected assets and directs federal agencies to prioritize rapid remediation under BOD 26-04.
-
update from blog.talosintelligence.com
Cisco Talos Threat Advisory - Active Exploitation of FMC Vulnerabilities (UAT-12197, UAT-11823, UAT-11988)
blog.talosintelligence.com · 34d ago · September 9th, 2026
Talos identified three independent clusters: UAT-12197 (web shell and JAR-based command executor), UAT-11823 (Sandworm-linked APT deploying Netcat reverse shells and a Cyclops Blink variant), and UAT-11988 (Qilin ransomware affiliate using static credentials and tunneling). The post includes Snort SIDs 66075-66080, 66883, and 66960-66961, plus IoC hashes and attacker IP addresses.
-
update from malware.news
Cisco security advisory (AV26-197) – Update 3
malware.news · 34d ago · September 9th, 2026
Serial number: AV26-197 Date: March 5, 2026 Updated: September 9, 2026 On March 4, 2026, Cisco published security advisories to address vulnerabilities in the following products. Included were critical updates for the following: Cisco Security Cloud Control (SCC) Firewall Management – all versions Cisco Secure Firewall Management Center (FMC) – all versions Cisco Secure Firewall Adaptive Security Appliance (ASA) – versions prior to 9.20.4.14 Cisco Secure Firewall Threat Defense (FTD) – all versions Update 1 On March 18, 2026, Cisco stated that CVE-2026-20131 is being actively exploited. The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.
-
mentioned by blog.talosintelligence.com
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First,
blog.talosintelligence.com · 34d ago · September 9th, 2026
-
mentioned by talosintelligence.com
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities Indicators extracted from public reporting. Source: https://
talosintelligence.com · 34d ago · September 9th, 2026
-
update from bleepingcomputer.com
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
bleepingcomputer.com · 34d ago · September 9th, 2026
The vulnerability has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices. Cisco did not disclose when the attacks began, who was behind them, or what post-exploitation activity was observed. The flaw is caused by an improper system process created at boot time and can be exploited by sending crafted HTTP requests to the web interface of an affected device. Cisco says it has already patched the cloud-hosted Security Cloud Control service. Cisco says there are no workarounds and recommends that customers upgrade to the latest software release. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known E
-
mentioned by www.bleepingcomputer.com
🤖 Cisco confirms CVE-2026-20079: maximum-severity authentication bypass in Secure Firewall Management Center (FMC), now actively exploited i
www.bleepingcomputer.com · 34d ago · September 10th, 2026
-
mentioned by zubiqo.com
Cisco confirms a 10.0 CVSS authentication bypass in its Secure FMC software is actively exploited, granting remote attackers root privileges
zubiqo.com · 34d ago · September 10th, 2026
-
mentioned by beyondmachines.net
Cisco Secure Firewall Management Center Under Active Attack Cisco Talos warns of active exploitation of two vulnerabilities (CVE-2026-20079
beyondmachines.net · 33d ago · September 10th, 2026
-
update from securityweek.com
Organizations Warned of Cisco Secure FMC Exploitation
securityweek.com · 33d ago · September 10th, 2026
In addition, ensuring that the FMC interface cannot be accessed from the internet significantly reduces the risk of exploitation.
-
update from thehackernews.com
🤖 CISA adds three actively exploited flaws (Cisco, Citrix, Fortinet) to its KEV catalog. Cisco's CVE-2026-20079 (CVSS 10.0) is an authentica
thehackernews.com · 33d ago · September 10th, 2026
🤖 CISA adds three actively exploited flaws (Cisco, Citrix, Fortinet) to its KEV catalog.
-
mentioned by blog.talosintelligence.com
Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware Indicators extracted from public reporting. Source: http
blog.talosintelligence.com · 33d ago · September 10th, 2026
-
update from bleepingcomputer.com
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
bleepingcomputer.com · 33d ago · September 10th, 2026
"Talos' analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors," Cisco Talos said . However, Cisco rates the flaw as High severity because it can be combined with other FMC vulnerabilities to elevate privileges. Cisco has already released hot fixes for both vulnerabilities and is urging customers to install them immediately. The company is also releasing a more comprehensive hardening that inc
-
update from www.bleepingcomputer.com
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers https:// bleepingcomputer.com/news/security/ cisco-fmc-flaws-exploited
www.bleepingcomputer.com · 33d ago · September 10th, 2026
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers https:// bleepingcomputer.com/news/security/ cisco-fmc-flaws-exploited
via X https://www.bleepingcomputer.com/news/security/cisco-fmc-flaws-exploited-by-ransomware-gang-state-sponsored-hackers/
-
update from osintsights.com
Cisco FMC Exploits Fuel Ransomware, APT Attacks Cisco FMC vulnerabilities are being exploited by threat actors, including state-sponsored gr
osintsights.com · 33d ago · September 10th, 2026
Cisco FMC Exploits Fuel Ransomware, APT Attacks Cisco FMC vulnerabilities are being exploited by threat actors, including state-sponsored gr
via Mastodon https://osintsights.com/cisco-fmc-exploits-fuel-ransomware-apt-attacks?utm_source=mastodon&utm_medium=social
-
mentioned by endoflife.ai
📖 New from endoflife.ai: Cisco FMC CVE-2026-20079: Fixed on Six Trains, Silent on 7.3 and 7.1 https:// endoflife.ai/article-cisco-fmc -cve-2
endoflife.ai · 33d ago · September 10th, 2026
-
update from cyberpress.org
Hackers Exploit Critical Cisco FMC Flaws to Gain Root Access and Deploy Malware
cyberpress.org · 32d ago · September 11th, 2026
The most severe issue, CVE-2026-20079, carries a CVSS score of 10.0. It lets attackers bypass authentication on unpatched Cisco Secure FMC instances and run scripts that ultimately grant root access to the underlying operating system. The first cluster, tracked as UAT-12197, exploited CVE-2026-20079 to deploy a JSP-based web shell in the CSM Tomcat webroot directory. The web shell Base64-decodes a parameter named “F6C1F0E7” and loads a Java class in the FMC Java process. Attackers subsequently placed a malicious cmd.jar file on the system. The JAR acts as a command executor, passing attacker-supplied commands to /bin/sh -c . Talos observed it being used to run OmniQuery.pl against FMC’s internal database and retrieve user
-
update from gbhackers.com
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
gbhackers.com · 32d ago · September 11th, 2026
These vulnerabilities can lead to unauthorized access, root-level code execution, credential theft, network reconnaissance, and malware deployment.
-
mentioned by www.bleepingcomputer.com
🤖 Cisco Talos: three threat clusters (ransomware + state-sponsored) exploited two patched Cisco Secure Firewall Management Center flaws — CV
www.bleepingcomputer.com · 32d ago · September 11th, 2026
-
mentioned by osintsights.com
Cisco FMC Exploits Fuel Ransomware, Credential Theft Cisco is urging customers to apply hotfixes immediately to protect against ransomware a
osintsights.com · 32d ago · September 11th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware Vulnerability | CRITICAL CVEs: CVE-2026-200
www.yazoul.net · 32d ago · September 11th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware Vulnerability | CRITICAL CVEs: CVE-2026-200
www.yazoul.net · 32d ago · September 11th, 2026
-
mentioned by www.bleepingcomputer.com
# Cisco confirms CVE-2026-20079 # SecureFMC flaw exploited in attacks https://www. bleepingcomputer.com/news/secu rity/cisco-confirms-cve-20
www.bleepingcomputer.com · 32d ago · September 11th, 2026
-
mentioned by theperimetersite.com
CISA put CVE-2026-20079 on the Known Exploited Vulnerabilities list on September 9, and if you're running a Cisco Secure Firewall Management
theperimetersite.com · 32d ago · September 11th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers Two critical authentication bypass vulnerabilities in Cis
threatnoir.com · 32d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
# Cisco # FMC flaws exploited by # ransomware gang, state-sponsored hackers https://www. bleepingcomputer.com/news/secu rity/cisco-fmc-flaws
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by www.techtimes.com
https://www. techtimes.com/articles/327384/ 20260912/cisco-firewall-manager-hacked-sandworm-espionage-implant-qilin-ransomware.htm?utm_sourc
www.techtimes.com · 30d ago · September 13th, 2026
-
update from securityweek.com
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
securityweek.com · 28d ago · September 15th, 2026
The tech giant explained that the critical flaw can be exploited to execute malicious SQL statements by sending them to the targeted user inside a specially crafted email. The company has released indicators of compromise (IoCs), but noted that because threat actors can obtain root privileges on a device, they can remove or hide IoCs to cover their tracks. The security hole affects both the physical and virtual versions of Secure Email Gateway in any configuration. This is only the second Cisco Secure Email Gateway vulnerability in the KEV list, after CVE-2025-20393, which China-linked threat actors sta
-
update from dev.to
The Management Plane Is the Attack Surface: What Cisco FMC's Exploited Zero-Day Teaches About Exposed Admin Interfaces Why this matters to y
dev.to · 28d ago · September 15th, 2026
The Management Plane Is the Attack Surface: What Cisco FMC's Exploited Zero-Day Teaches About Exposed Admin Interfaces Why this matters to y
via Mastodon https://dev.to/stark_zhuang_df5076f35c68/the-management-plane-is-the-attack-surface-what-cisco-fmcs-exploited-zero-day-teaches-about-35ha
-
update from undercodenews.com
Reward: You've been granted the Undead Inbox title. It comes with no privileges you still control. https:// undercodenews.com/cisco-secure -
undercodenews.com · 28d ago · September 15th, 2026
Reward: You've been granted the Undead Inbox title. It comes with no privileges you still control.
-
update from securityweek.com
Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
securityweek.com · 28d ago · September 15th, 2026
submitted by /u/sunychoudhary [link] [comments]
via reddit r/cybersecurity: Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
-
update from diesec.com
CVE-2026-59822 (CVSS 8.8): LiteLLM MCP proxy lets attackers skip OAuth2 login entirely, no credentials needed. First MCP flaw in CISA KEV. E
diesec.com · 25d ago · September 18th, 2026
CVE-2026-59822 (CVSS 8.8): LiteLLM MCP proxy lets attackers skip OAuth2 login entirely, no credentials needed.