All news
vulnerability disclosure

Precursor Intelligence

Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild

CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV today.

12 September 2026
CiscoCVE-2026-20079FMCCISA KEVauth-bypass
Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild

At a glance

3 CVEs

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-200791088.2%ExploitedAvailable90 · Critical
CVE-2026-201311043.2%ExploitedAvailable87 · Critical
CVE-2026-203165.335.1%Exploited—74 · High

Technology affected

Cisco · Secure Firewall Management Center (FMC)Cisco · Secure FMC SoftwareCisco · Secure FMCCisco · Security Cloud Control (SCC) Firewall Management

Malware & tooling

license.tmpRansomware

Timeline

  1. Disclosure

    CVE-2026-20079 fixed / disclosed in early March 2026

  2. Advisory

    Rapid Response issued for CVE-2026-20079

  3. Advisory

    Cisco released security updates to patch two maximum-severity vulnerabilities in Secure FMC

  4. Exploited in wild

    Cisco confirmed CVE-2026-20316 had been exploited by attackers

  5. Disclosure

    CVE-2026-20316 disclosed with a fix made available

  6. Exploitation

    Cisco PSIRT became aware of active exploitation

  7. Confirmation

    Cisco confirmed active exploitation

Indicators of compromise

  • other/var/tmp/license.tmp

Vulnerability details

CVE CVSS EPSS KEV PoC PRS risk
CVE-2026-20316 5.3 11.2% ✅ listed — 74.04 (High)
CVE-2026-20079 10.0 75.8% ✅ listed available 87.0 (Critical)
CVE-2026-20131 10.0 33.4% ✅ listed available 88.0 (Critical)

Affected versions and patching The following FMC releases are affected by CVE-2026-20079: - 7.0.x: < 7.0.9

  • 7.2.x: < 7.2.11
  • 7.4.x: < 7.4.4
  • 7.6.x: < 7.6.4
  • 7.7.x: < 7.7.12 CVE-2026-20131 shares the same 7.0, 7.2, and 7.7 branches but requires 7.4.6 and 7.6.5. It also affects 10.0.x (< 10.0.1), which 20079 does not cover. Cisco says there are no workarounds. Customers should apply the hot fixes for the affected branch or upgrade to the latest release. A comprehensive hardening release bundling both hot fixes with additional internally discovered vulnerabilities lands the week of September 16, 2026. To confirm exploitation, search the device's log for the dropped file: ``` grep '/var/tmp/license.tmp' /var/log/messages

## Key points

- CVE-2026-20079 is a CVSS 10.0 authentication bypass in the Cisco Secure FMC web interface that lets an unauthenticated remote attacker execute scripts/commands as root via crafted HTTP requests.
- Cisco PSIRT became aware of active exploitation in August 2026 and updated the advisory on September 9, 2026 to confirm in-the-wild use.
- CISA added CVE-2026-20079 to the KEV catalog today, ordering FCEB agencies to patch by September 12, 2026.
- The flaw is chained with CVE-2026-20316 (static credential, CVSS 5.3) for privilege escalation; both share the same /var/tmp/license.tmp IOC and hot fixes.
- Cisco says there are no workarounds; customers must upgrade to the latest FMC release or apply the hot fix.

## Further reading & sources

- [Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets](https://www.runzero.com/blog/cisco-secure-fmc) — RunZero
- [Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/)
- [Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) - Help Net Security](https://www.helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316/)
- [Cisco warns of max severity Secure FMC flaws giving root access](https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/)
- [Cisco warns of FMC static credential flaw exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/)