[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUkMmXCJeFVZ51G_JKUW40H4W9ufLjhrQvbGhEp95xzY":3,"$fObkkbSfwI9djl-YPmrY-MoLS8Ff-8t9SBoiNefnxLtg":88},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":84,"created_at":85,"updated_at":86,"published_at":87},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV today.","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, confirming active exploitation after PSIRT became aware in August 2026; CISA added the CVE to its KEV catalog with a September 12, 2026 due date for FCEB agencies.",[10,11,12,13,14],"Cisco","CVE-2026-20079","FMC","CISA KEV","auth-bypass","# Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild\n\n*CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV today.*\n\n**Tags:** `Cisco` `CVE-2026-20079` `FMC` `CISA KEV` `auth-bypass`\n\n> Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, confirming active exploitation after PSIRT became aware in August 2026; CISA added the CVE to its KEV catalog with a September 12, 2026 due date for FCEB agencies.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-20316 | 5.3 | 11.2% | ✅ listed | — | 74.04 (High) |\n| CVE-2026-20079 | 10.0 | 75.8% | ✅ listed | available | 87.0 (Critical) |\n| CVE-2026-20131 | 10.0 | 33.4% | ✅ listed | available | 88.0 (Critical) |\n\n## Affected versions and patching The following FMC releases are affected by CVE-2026-20079: - 7.0.x: \u003C 7.0.9\n\n- 7.2.x: \u003C 7.2.11\n- 7.4.x: \u003C 7.4.4\n- 7.6.x: \u003C 7.6.4\n- 7.7.x: \u003C 7.7.12 CVE-2026-20131 shares the same 7.0, 7.2, and 7.7 branches but requires 7.4.6 and 7.6.5. It also affects 10.0.x (\u003C 10.0.1), which 20079 does not cover. Cisco says there are no workarounds. Customers should apply the hot fixes for the affected branch or upgrade to the latest release. A comprehensive hardening release bundling both hot fixes with additional internally discovered vulnerabilities lands the week of September 16, 2026. To confirm exploitation, search the device's log for the dropped file: ```\ngrep '\u002Fvar\u002Ftmp\u002Flicense.tmp' \u002Fvar\u002Flog\u002Fmessages\n``` If the entry is present, the vulnerability was exploited on that FMC instance.\n\n## Key points\n\n- CVE-2026-20079 is a CVSS 10.0 authentication bypass in the Cisco Secure FMC web interface that lets an unauthenticated remote attacker execute scripts\u002Fcommands as root via crafted HTTP requests.\n- Cisco PSIRT became aware of active exploitation in August 2026 and updated the advisory on September 9, 2026 to confirm in-the-wild use.\n- CISA added CVE-2026-20079 to the KEV catalog today, ordering FCEB agencies to patch by September 12, 2026.\n- The flaw is chained with CVE-2026-20316 (static credential, CVSS 5.3) for privilege escalation; both share the same \u002Fvar\u002Ftmp\u002Flicense.tmp IOC and hot fixes.\n- Cisco says there are no workarounds; customers must upgrade to the latest FMC release or apply the hot fix.\n\n## Further reading & sources\n\n- [Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fcisco-secure-fmc) — RunZero\n- [Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks\u002F)\n- [Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F09\u002F10\u002Fcisco-fmc-exploited-cve-2026-20079-cve-2026-20316\u002F)\n- [Cisco warns of max severity Secure FMC flaws giving root access](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access\u002F)\n- [Cisco warns of FMC static credential flaw exploited in zero-day attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3",{"cves":18,"iocs":40,"malware":44,"timeline":49,"technologies":75},[19,27,32],{"id":11,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-20079",10,0.8818,"Critical",89.89,"3.1",{"id":28,"kev":20,"poc":20,"url":29,"cvss":22,"epss":30,"risk_band":24,"risk_score":31,"cvss_version":26},"CVE-2026-20131","\u002Fvulnerabilities\u002FCVE-2026-20131",0.4317,87,{"id":33,"kev":20,"poc":34,"url":35,"cvss":36,"epss":37,"risk_band":38,"risk_score":39,"cvss_version":26},"CVE-2026-20316",false,"\u002Fvulnerabilities\u002FCVE-2026-20316",5.3,0.351,"High",74.11,[41],{"type":42,"value":43},"other","\u002Fvar\u002Ftmp\u002Flicense.tmp",[45,47],{"name":46},"license.tmp",{"name":48},"Ransomware",[50,54,57,60,64,67,71],{"date":51,"event":52,"description":53},"2026-03","Disclosure","CVE-2026-20079 fixed \u002F disclosed in early March 2026",{"date":51,"event":55,"description":56},"Advisory","Rapid Response issued for CVE-2026-20079",{"date":58,"event":55,"description":59},"2026-03-04","Cisco released security updates to patch two maximum-severity vulnerabilities in Secure FMC",{"date":61,"event":62,"description":63},"2026-07","Exploited in wild","Cisco confirmed CVE-2026-20316 had been exploited by attackers",{"date":65,"event":52,"description":66},"2026-07-29","CVE-2026-20316 disclosed with a fix made available",{"date":68,"event":69,"description":70},"2026-08","Exploitation","Cisco PSIRT became aware of active exploitation",{"date":72,"event":73,"description":74},"2026-09-09","Confirmation","Cisco confirmed active exploitation",[76,78,80,82],{"vendor":10,"product":77},"Secure Firewall Management Center (FMC)",{"vendor":10,"product":79},"Secure FMC Software",{"vendor":10,"product":81},"Secure FMC",{"vendor":10,"product":83},"Security Cloud Control (SCC) Firewall Management","vulnerability_disclosure","2026-09-12T07:10:09.180903+00:00","2026-10-16T12:28:44.165612+00:00",null,{"articles":89},[90,101,112,125],{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":99,"story_type":84,"created_at":100},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[95,96,13,97,98],"CVE-2026-18556","N-Able N-Central","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":102,"title":103,"summary":104,"tags":105,"hero_image_url":109,"story_type":110,"created_at":111},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[106,107,97,13,108],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":113,"title":114,"summary":115,"tags":116,"hero_image_url":123,"story_type":84,"created_at":124},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[117,118,119,120,121,122],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":126,"title":127,"summary":128,"tags":129,"hero_image_url":136,"story_type":84,"created_at":137},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[130,131,132,133,134,135],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00"]