Organizations Warned of Cisco Secure FMC Exploitation
Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.
Cisco and CISA flagged active exploitation of CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center allowing remote, unauthenticated attackers to run malicious scripts and gain root access via crafted HTTP requests. Cisco patched the flaw in early March and added IoCs in late July, but confirmed active exploitation in its September 9 advisory; CISA added it to the KEV catalog requiring federal remediation by September 12. Talos identified three activity clusters exploiting CVE-2026-20079 and CVE-2026-20316, including state-sponsored and financially motivated actors, and this is the third FMC vulnerability in KEV this year after CVE-2026-20316 and CVE-2026-20131.
- CVE-2026-20079 is a critical unauthenticated bypass enabling script execution and root access on Cisco Secure FMC.
- CISA added the flaw to its KEV catalog with a September 12 remediation deadline for federal agencies.
- Talos tracked three clusters: UAT-12197 (web shell, JAR credential theft), UAT-11823 (Sandworm, Cyclops Blink), and UAT-11988 (Qilin-linked, targeting CVE-2026-20316).
- CVE-2026-20316 and CVE-2026-20131 were also exploited as zero-days earlier in 2026.
- Defenses: apply patches and keep the FMC interface off the internet.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1105 Ingress Tool TransferT1555 Credentials from Password Stores
- Malware
- Cyclops Blink
- Organizations
- Cisco Talos
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20131 | Unauthenticated Java Deserialization RCE in Cisco FMC and SCC | 10.0 | 43% | KEVRansomwarePoC | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
From the original article
2 min read at securityweek.com
Cisco and CISA have flagged exploitation of CVE-2026-20079, a vulnerability disclosed in March 2026. The post Organizations Warned of Cisco Secure FMC Exploitation appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.