Critical Cisco FMC Authentication Bypass Vulnerability Under Active Exploitation

Cisco's Secure Firewall Management Center (FMC) Software has a critical authentication bypass vulnerability (CVE-2026-20079) that allows unauthenticated remote attackers to execute scripts and gain root access to affected devices. This vulnerability is due to improper system processes created at boot time and can be exploited via crafted HTTP requests. Cisco has released patches, but active exploitation is confirmed, with attackers deploying web shells and other malicious tools. Another related vulnerability (CVE-2026-20316) allows low-privileged account logins and can be exploited in conjunction with CVE-2026-20079. Cisco advises immediate patching to mitigate risks. The vulnerabilities are particularly concerning for organizations with internet-facing management interfaces. Talos Intelligence has identified multiple clusters of exploitation linked to various threat actors, including ransomware operators.

Key Points: • CVE-2026-20079 allows unauthenticated remote access to Cisco FMC devices. • Active exploitation is confirmed, with attackers deploying web shells and malware. • Immediate patching is critical to mitigate risks associated with these vulnerabilities.