Cisco FMC Under Attack: A CVSS-10 Auth Bypass Rooted Your Firewall Brain Before Cisco Said So

A CVSS 10.0 hole in Cisco’s firewall manager is being exploited, and this time there is no “no evidence” line in the advisory

Cisco confirmed this week that CVE-2026-20079, an authentication bypass in Cisco Secure Firewall Management Center (FMC), is under active exploitation. The score is the ugliest one in the book: CVSS 10.0. An unauthenticated attacker anywhere on the internet sends crafted HTTP requests to the FMC web interface and runs commands as root. No credentials, no user clicking anything.

What makes this uncomfortable for security teams is the timeline. Cisco disclosed the flaw back in March and stated there was no evidence of exploitation. Six months of that assurance, and then in August the PSIRT quietly noticed attackers were already inside. The advisory got its exploitation confirmation on Wednesday, and CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of September 12 for US federal agencies.

The static credential that ties it all together

There is a second CVE in this story that most coverage glossed over. On July 29, Cisco disclosed CVE-2026-20316, a static credential for a low-privileged account baked into the FMC boot process. Cisco rated it High and said it was being actively exploited, because that foothold could be combined with other FMC bugs to climb to full control.

When Cisco updated the CVE-2026-20079 advisory that same week, it included the exact same indicators of compromise as the static credential flaw, but stopped short of confirming 20079 was exploited. Cisco also shipped identical hot fixes for both. BleepingComputer asked directly whether the two flaws were connected in real attacks. Cisco’s response was a statement recommending customers apply the fixes, and nothing else.

The company’s own example log entry is dated July 23. That is a sudo event where the web server user, www, executed a script against a file in /var/tmp/license.tmp as root:

Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

Cisco says if you find that entry in /var/log/messages, the device “may have been exploited.” Note the date. Cisco claims it only learned of active exploitation in August, yet its own IOC evidence points at July 23. Shared indicators, identical patches, and a log entry from before the vendor says it knew. The reasonable read is that both flaws were used together in the same campaign for weeks, and the public confirmation lagged the reality.

Why a management center is worth more than a firewall

If you run Cisco Secure Firewall in any size, the FMC is the crown jewel. It’s the brain that pushes policy to every managed Firepower threat device in the estate. Root on the FMC means an attacker can rewrite access rules, disable inspection on the path your payment traffic takes, or quietly pivot downstream to every managed firewall at once. One box, total visibility into your perimeter topology, and the keys to reconfigure it.

Patch order matters here, and Cisco is explicit about it: the hot fixes stop future exploitation but do nothing for a device that is already compromised. If you find the IOC, patching is not remediation. You rebuild.

What African enterprises should do this week

• Inventory first. Find every FMC instance and Security Cloud Control connection. Banks, telcos, and payment gateways on the continent lean heavily on Cisco firewall estates, and management interfaces often live on “internal” networks that are one VPN misconfiguration away from exposure.
• Grep the logs. Search /var/log/messages on every FMC for /var/tmp/license.tmp and sudo events from the www user. This is a five-minute check that tells you whether you are in the patch-only lane or the rebuild lane.
• Apply the hot fix, then assume nothing. Upgrade to the fixed release immediately. If any IOC shows up, engage Cisco TAC and treat the device as hostile until rebuilt from known-good media.
• Lock the management plane down. An FMC web interface reachable from the public internet is a 10.0 waiting for its next bad month. Restrict access to a dedicated management VLAN, front it with an authenticating full-tunnel VPN, and log everything that touches it.

I keep coming back to the governance angle more than the exploit itself. A maximum-severity auth bypass sat in a vendor advisory for six months carrying a “no evidence of exploitation” line while, by the vendor’s own log evidence, attackers were running sudo as root on customer appliances. Nobody is owed a perfect disclosure timeline, but a management console for your entire perimeter should never sit exposed long enough for that gap to matter.

eHawu Secure Network keeps your management plane off the public internet entirely. Full-tunnel WireGuard VPN with device identity, zero-trust access policies for admin interfaces, and logging that makes an IOC hunt like the one above a query instead of a weekend. Built and operated in South Africa for African enterprises that can’t wait six months to find out their firewall brain was already someone else’s shell. Talk to us at ehawu.africa.