GoKawiilCisco confirms active exploitation of critical Secure FMC bug CVE-2026-20079
Cisco has verified that attackers are actively exploiting CVE-2026-20079, a maximum-severity (CVSS 10.0) flaw in its Secure Firewall Management Center software that lets unauthenticated remote attackers bypass login and run commands as root. The company first disclosed the bug in March without evidence of exploitation, but updated its advisory this week to acknowledge PSIRT detected active attacks in August, though it hasn't shared attacker identity or attack timeline details. CISA has since added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 12 to patch.
GoKawiil's interpretation of the reporting above, not reported fact.
A root-level authentication bypass in firewall management software is especially dangerous because FMC controls network security policy across an organization's infrastructure, giving attackers a path to disable defenses entirely. With no workaround available and evidence suggesting exploitation may predate Cisco's official acknowledgment, organizations running Secure FMC face urgent pressure to patch before attackers who already have footholds expand their access.
- CVE-2026-20079 scores a maximum 10.0 CVSS and allows root-level command execution without authentication.
- Cisco only confirmed active exploitation in August despite disclosing the flaw in March, and IOCs suggest attacks may have started even earlier.
- CISA's KEV listing forces federal agencies to patch by September 12, 2026; no workaround exists so upgrading is mandatory for all affected users.
YubiKey 5 NFC Security Key — When authentication bypass bugs are being actively exploited, hardware-backed MFA is one of the strongest defenses admins can add to their own accounts. The YubiKey 5 NFC supports FIDO2/WebAuthn, OTP and smart card protocols, works over USB-A and NFC, and needs no batteries or network connection.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-09
Published there as: “Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.