Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication bypass vulnerability in its Secure Firewall Management Center (FMC) software. The flaw, which carries a maximum CVSS score of 10.0, allows unauthenticated, remote attackers to execute scripts and commands with root privileges on affected devices by sending specially crafted HTTP requests to the web interface.
The company's Product Security Incident Response Team (PSIRT) became aware of active exploitation in August 2026, according to an update to the CVE-2026-20079 advisory. Cisco initially disclosed the vulnerability in March 2026, stating at the time that there was no evidence of in-the-wild exploitation. The vulnerability stems from an improperly configured system process created during boot time.
While Cisco confirmed exploitation in August, indicators of compromise (IOCs) published in a July advisory update suggest potential earlier activity. On July 29, Cisco disclosed CVE-2026-20316, a separate high-severity static credential vulnerability in Secure FMC, which the company confirmed was actively exploited. At that time, the CVE-2026-20079 advisory was updated to include the same IOCs as CVE-2026-20316, though exploitation of CVE-2026-20079 was not confirmed until recently.
The shared IOCs include a specific log entry pattern in `/var/log/messages` related to `/var/tmp/license.tmp`. An example log entry provided by Cisco is dated July 23, 2026, which precedes the August date when PSIRT confirmed exploitation of CVE-2026-20079. The presence of this log entry indicates that a device "may have been exploited."
Cisco also released identical hotfixes for both CVE-2026-20316 and CVE-2026-20079 in July. This commonality in IOCs and hotfixes suggests that both vulnerabilities might have been leveraged in the same attack campaigns.
The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management. Cisco has already patched its cloud-hosted Security Cloud Control service. There are no known workarounds for the on-premise Secure FMC software, and customers are advised to upgrade to the latest software release to mitigate the risk.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies are mandated to secure vulnerable systems by September 12, 2026.
Customers who discover the specified indicators of compromise on their devices are urged to contact the Cisco Technical Assistance Center (TAC) for support. Cisco warns that applying the available hotfixes will prevent future exploitation but will not remediate systems that have already been compromised.
