Current advisory · Verified against Cisco guidance updated 9 September 2026. Check the primary source for revisions before acting.
01

What happened

Cisco has updated its advisory for CVE-2026-20079 to confirm that the vulnerability is being actively exploited. The flaw affects the web interface of Cisco Secure Firewall Management Center (FMC) Software and carries the maximum CVSS base score of 10.0.

An unauthenticated, remote attacker can send crafted HTTP requests to an affected management interface, bypass authentication and execute scripts or commands with root access to the underlying operating system. Cisco says the issue is caused by an improper system process created at boot time.

The advisory was first published on 4 March 2026. Cisco added indicators of compromise and hot-fix guidance in later updates, then confirmed observed exploitation on 9 September 2026.

02

Why it matters

FMC is a central management point for firewall policy and security operations. Root-level compromise of the management appliance could give an attacker powerful access to a high-trust part of the environment. Depending on the deployment and attacker activity, that may create risk to configurations, credentials, monitoring data and the firewalls managed through FMC.

Cisco notes that keeping the FMC management interface off the public internet reduces the attack surface. It does not make an affected installation safe: the vulnerability applies regardless of device configuration, and an attacker with another route to the interface may still be able to reach it.

03

Who is affected

Organisations running on-premises Cisco Secure FMC Software should treat the advisory as applicable until they have verified their installed release and remediation status. Cisco also lists the Firewall Management capability within Cisco Security Cloud Control as affected, but says it has already deployed the fix to those SaaS environments and no customer action is required.

Cisco confirms that Firewall Device Manager, ASA Software and Secure Firewall Threat Defense Software are not affected by this vulnerability. Security Cloud Control itself, formerly Defense Orchestrator, is also listed as not vulnerable; the affected SaaS component is specifically its Firewall Management capability.

04

What to do next

  1. Identify every FMC deployment. Confirm appliance owners, installed releases, management-interface addresses and whether each instance is internet-facing or reachable from other network zones. Include virtual and supplier-managed deployments.
  2. Apply Cisco's fixed software or hot fix urgently. There is no workaround. Use the Cisco advisory and Software Checker to select the correct remediation for the exact release, then verify the installed result.
  3. Check for possible exploitation. Preserve relevant evidence and follow Cisco's indicator-of-compromise instructions. In FMC expert mode, Cisco advises reviewing system messages for suspicious package_info activity involving /var/tmp/license.tmp.
  4. Escalate suspected compromise. If the indicator is present or other evidence suggests exploitation, activate the incident-response process and contact Cisco TAC. Cisco warns that the hot fixes prevent future exploitation but may not address an existing compromise.
  5. Reduce management-plane exposure. Restrict access to authorised administration paths and review any public exposure. Treat this as defence in depth, not a substitute for remediation.
05

For security leaders

This is an actively exploited, unauthenticated path to root access with no workaround. Ask for a time-bound position covering the number of FMC instances, their exposure, remediation status and whether compromise checks have been completed. Keep unverified assets and supplier-owned deployments visible as open risk rather than reporting only confirmed patch completions.

06

For technical teams

Cisco currently lists hot fixes for FMC releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Do not infer the correct file from the release family alone: confirm the exact version and current guidance in Cisco's advisory or Software Checker. Before remediation, preserve the logs needed for investigation. After the change, validate the software or hot-fix state, management access, policy deployment and device connectivity.

07

For GRC teams

Record applicability, asset ownership, exposure and evidence of remediation. Where an upgrade is delayed, document the operational constraint, interim access restrictions, accountable risk owner and next decision point. For managed services, obtain written confirmation of the provider's assessment, remediation and compromise review.

08

What to monitor next

Monitor Cisco's advisory for revised indicators, remediation guidance and affected-release information. Watch for new findings from Cisco TAC or your incident-response team, and continue reviewing management-plane telemetry after patching. If the investigation suggests compromise, widen the assessment beyond the FMC appliance to credentials, managed devices and administrative activity.

Primary sources

Start with the original guidance and check for updates before applying this runbook.