Cybersecurity experts are sounding the alarm as Cisco confirms a critical vulnerability in its Secure Firewall Management Center (FMC) software has been actively exploited in attacks. The flaw, tracked as CVE-2026-20079, allows unauthenticated hackers to bypass authentication and execute scripts with root privileges on vulnerable devices.
The vulnerability affects Cisco’s Secure FMC Software and Security Cloud Control Firewall Management, and has a maximum CVSS score of 10.0 – the highest possible rating. This means that attackers can exploit it remotely without needing any login credentials or access to the system. According to Cisco, the flaw is caused by an improper system process created at boot time, which can be exploited by sending crafted HTTP requests to the web interface.
Cisco first disclosed CVE-2026-20079 in March, but at the time, there was no evidence of exploitation. However, the company’s security team became aware that the vulnerability was being actively exploited in attacks in August 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog, which means federal agencies have until September 12, 2026, to secure vulnerable systems.
One of the concerns is that attackers may be using this vulnerability in combination with another Secure FMC flaw, tracked as CVE-2026-20316. This vulnerability was also recently disclosed by Cisco and has been actively exploited in attacks. In fact, Cisco released identical hot fixes for both vulnerabilities on July 29, which suggests that attackers may be using a similar attack vector.
Cisco recommends that customers upgrade to the latest software release immediately, as there are no workarounds available. The company has already patched its cloud-hosted Security Cloud Control service, but device administrators will need to take action to ensure their systems are secure. This includes searching for specific log entries on their devices to determine if they have been affected.
The fact that attackers have been exploiting this vulnerability for several weeks raises concerns about the potential impact on organizations using Cisco’s Secure FMC software. As cybersecurity experts, we need to emphasize the importance of staying up-to-date with patches and updates, as well as monitoring systems closely for signs of suspicious activity.
In light of this incident, it’s essential for device administrators to take immediate action to secure their systems. This includes checking for any available updates, applying them promptly, and monitoring system logs regularly for potential signs of exploitation. If you discover indicators of compromise on your devices, contact Cisco’s Technical Assistance Center (TAC) for support – installing hot fixes will prevent future exploitation, but it won’t remediate devices that have already been compromised.
Ultimately, this incident serves as a reminder that cybersecurity threats are evolving rapidly, and organizations need to stay vigilant and proactive in protecting their systems. By prioritizing security updates and monitoring system activity closely, you can help prevent attacks like these from succeeding.
Source: Bleeping Computer — 2026-09-09