Cisco firewall manager flaw rated 10 out of 10 is under active attack

Key points

• Cisco confirmed on Wednesday that CVE-2026-20079, a maximum-severity flaw in its Secure Firewall Management Center, is being actively exploited.
• The bug scores 10.0 out of 10 on the industry severity scale and lets a remote attacker take over the device as the root user without any login.
• Cisco says its security team learned of the attacks in August 2026, but a log entry it published points to exploitation as early as July 23.
• The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch by September 12, 2026.
• Cisco says there is no workaround, only the software update, and installing the fix doesn't clean up devices that have already been broken into.

Cisco has confirmed that hackers are actively exploiting a top-severity flaw in the software administrators use to run its firewalls. The bug, CVE-2026-20079, sits in Secure Firewall Management Center, known as FMC, the central console for managing Cisco firewalls across a company.

It scores a perfect 10.0 on the CVSS severity scale, the industry's 0-to-10 rating for how dangerous a flaw is. That's the ceiling.

What does the bug actually let attackers do?

It lets an outsider skip the login screen entirely and run commands on the firewall manager as the root user, the account with total control. No credentials required. A specially crafted HTTP request to the device's admin interface is enough.

This is an authentication bypass: the system fails to check who's asking before opening the door. Once inside as root, an attacker can read configurations, push changes to every firewall the console manages, or use the box as a foothold deeper into the network. Multi-factor authentication wouldn't have helped here, because the flaw sidesteps the login check altogether. The root cause, according to Cisco's advisory, is an improperly created system process that runs at boot time.

Who is affected and what needs patching?

The flaw affects Cisco Secure FMC Software and the Cisco Security Cloud Control Firewall Management service. Cisco has already fixed the cloud-hosted version itself, so cloud customers don't need to act. Everyone running FMC on their own hardware needs to install the latest release. There's no workaround.

How long has this been going on?

Probably longer than Cisco first let on. Cisco's advisory says its Product Security Incident Response Team became aware of exploitation in August 2026. But indicators of compromise, the digital fingerprints attackers leave behind, tell a slightly older story.

On July 29, Cisco disclosed a separate FMC flaw, CVE-2026-20316, caused by a built-in account with a hardcoded password. Cisco confirmed that one had been exploited. As BleepingComputer noted at the time, Cisco quietly added the same fingerprints to the CVE-2026-20079 advisory without saying it had been exploited too.

The example log line Cisco published, showing suspicious use of a licensing script at /var/tmp/license.tmp, is dated July 23. Weeks before Cisco publicly acknowledged attacks on the perfect-10 bug. Identical hot fixes for both flaws and shared forensic indicators all point to the two being used together in the same intrusions. We first covered CVE-2026-20079 on 29 July 2026, when the static-credential companion flaw was disclosed.

What should defenders do right now?

Patch, then hunt. Cisco tells administrators to search /var/log/messages for activity involving /var/tmp/license.tmp. If you find it, the fix stops future attacks but won't clean up a box that's already owned. Call Cisco's Technical Assistance Center and treat the device as compromised.

CISA has given U.S. Federal civilian agencies until September 12, 2026 to sort it out. Everyone else should treat that as a sensible ceiling, not a target. A maximum-severity auth bypass with a months-long exploitation window and no workaround is exactly the kind of thing that rewards the teams who patch on day one and punishes everyone who waits.