CVE-2026-20079: Cisco Firewall Management Center Perfect-Score Auth Bypass Exploited in the Wild, Three Attack Clusters Identified

Cisco Talos discloses in-the-wild exploitation of FMC perfect-score auth bypass CVE-2026-20079. Unauthenticated attackers can obtain root. Three clusters include ransomware operators and Sandworm-linked activity.

Cisco Talos disclosed on September 9 that CVE-2026-20079, a perfect-score authentication bypass in Cisco Secure Firewall Management Center (FMC), is exploited in the wild. An attacker with no credentials can execute scripts on affected devices and obtain root on the underlying OS. Talos identified three independent attack clusters; one has reached pre-ransomware reconnaissance. CISA added the vulnerability to the KEV catalog the same day.

Overview

CVE-2026-20079 is an authentication bypass in the FMC web interface (CWE-288), CVSS v3.1 10.0. Root cause: an improper system process created at startup with flawed authentication logic. An attacker sends crafted HTTP requests to the management interface, bypasses authentication, executes scripts as the service identity, and escalates to root. Disclosed in March 2026 with Cisco's semi-annual security advisory. Affects nearly all FMC versions from 7.0 through 10.0.1. Cisco confirmed observed exploitation since August 2026.

Also disclosed: CVE-2026-20316 (CVSS 5.3), a static-credentials issue allowing remote login as a low-privileged account. Limited on its own; combinable with other FMC flaws for privilege escalation.

Technical Details: Three Attack Clusters

Talos clustered in-the-wild activity by infrastructure and tooling:

• UAT-12197: after exploiting CVE-2026-20079, deploys a JSP WebShell in the Tomcat webroot (dynamically loads a class via Base64-decoded parameter F6C1F0E7), then implants cmd.jar command executor, queries the internal database to steal user authentication data.

• UAT-11823: chains both vulnerabilities, deploys a Netcat-based reverse shell and proxy tooling, ultimately implants a Cyclops Blink variant—malware previously attributed by the US and UK governments to Russian APT Sandworm.

• UAT-11988: Talos assesses with high confidence as a ransomware operator. After entry via static credentials (CVE-2026-20316), abuses built-in FMC tools living-off-the-land for broad reconnaissance, deploys tunnels for persistence, harvests credentials, and compiles a list of endpoints to encrypt. TTPs align with the Qilin ransomware affiliate.

Impact Assessment

FMC centrally manages all Cisco Secure Firewall policy for an enterprise. Compromise means the entire firewall domain is lost: attackers can view network architecture and security policy, tamper with access control, and steal inter-device communication keys, paving the way for lateral movement and ransomware. Instances with the management interface exposed to the public internet carry the highest risk. Intranet-only reachability shrinks the attack surface but is not equivalent to safety.

Remediation

No temporary mitigations exist. Cisco has released hotfixes per version. Install immediately:

`7.0.x  → Hotfix GB-7.0.9.1-3
7.2.x  → Hotfix HL-7.2.11.1-4
7.4.x  → Hotfix HG-7.4.7.1-3
7.6.x  → Hotfix CY-7.6.5.1-2
7.7.x  → Hotfix AM-7.7.12.1-2
10.0.x → Hotfix P-10.0.1.1-2`

Compromise check: in FMC expert mode, run the following. If output contains records related to /var/tmp/license.tmp, treat the device as compromised:

`zgrep "package_info.*license" /var/log/messages*`

Typical compromise artifact: the www user executes package_info.pl as root and writes a license file. On the network side, deploy Cisco Snort rules 66075-66080 to cover attack traffic. Hotfixes only prevent further exploitation; they do not remove WebShells or persistence already implanted. Instances matching the self-check should contact Cisco TAC for incident response. The week of September 14 Cisco will also ship a comprehensive hardening release covering additional internally discovered vulnerabilities.

References

• Cisco Talos: Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

• Cisco Security Advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2

• CVE-2026-20079 record