Cisco has confirmed that CVE-2026-20079, a maximum-severity (CVSS 10.0) authentication bypass in its Secure Firewall Management Center (FMC) software, is being actively exploited in the wild. The flaw stems from an improper process created at boot time and is reachable by sending crafted HTTP requests to the device’s web interface — no credentials required. A successful exploit gives an attacker the ability to run arbitrary scripts and commands as root, effectively handing over full administrative control of the firewall management console. Cisco notes that its cloud-hosted Security Cloud Control service has already been patched on the backend, but on-premises FMC installations remain vulnerable until administrators apply the latest software update.
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog today, setting a September 12, 2026 deadline for Federal Civilian Executive Branch agencies to remediate. Cisco says active exploitation was first identified by its security team in August, though indicators of compromise in a July advisory suggest exploitation may predate that discovery. Cisco has published a detection guidance log entry — administrators should search /var/log/messages for activity referencing /var/tmp/license.tmp. There are no workarounds; upgrading to a fixed software release is the only mitigation. This is a separate vulnerability from CVE-2026-20316 (the static-credential flaw in the same product that was actively exploited in July), though Cisco released hot fixes covering both under the same update package.
How to check if you’re affected
Affected products include Cisco Secure Firewall Management Center Software (on-premises deployments) and Cisco Security Cloud Control Firewall Management. To detect a possible compromise, search /var/log/messages on the FMC device for entries referencing /var/tmp/license.tmp. Cisco has published the specific log-entry pattern in its advisory. There are no workarounds — upgrade to the fixed software release immediately. Cisco Security Cloud Control (the hosted service) was already patched by Cisco and requires no customer action.
Sources
- BleepingComputer — Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
- CISA Known Exploited Vulnerabilities Catalog — CVE-2026-20079 (added 2026-09-09)