Skip to content
Critical Cisco FMC Vulnerabilities Under Active Exploitation

Critical Cisco FMC Vulnerabilities Under Active Exploitation

First seen 9 Sep 2026, 20:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 10, 2026 at 20:17 UTC
  • •CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0.
  • •Active exploitation is confirmed, with attackers using these vulnerabilities to deploy malware and backdoors.
  • •Cisco has released patches, but many systems remain vulnerable due to lack of updates.

Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and gain root access by sending crafted HTTP requests. CVE-2026-20316, with a CVSS score of 5.3, enables attackers to log in using static low-privileged credentials. Cisco has confirmed active exploitation of these vulnerabilities, with three distinct clusters of attacks identified, including one attributed to the Russian APT group Sandworm. Patches were released in March and July 2026, but many systems remain unpatched. Organizations are urged to apply the available updates immediately to mitigate the risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 38d ago How this analysis works

Timeline

2026-03-04
CVE-2026-20079 published
Cisco disclosed a critical authentication bypass vulnerability in FMC Software.
Sec.Cloudapps.Cisco
2026-07-29
CVE-2026-20316 published
Cisco disclosed a vulnerability allowing unauthenticated access via static credentials.
Helpnetsecurity
2026-08-11
CVE-2026-20349 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-09
CVE-2026-20079 added to CISA KEV
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog due to active exploitation.
Sec.Cloudapps.Cisco
2026-09-09
CVE-2026-20316 added to CISA KEV
CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog.
Helpnetsecurity
2026-09-09
CVE-2026-87491 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-10
Cisco confirms active exploitation
Cisco's Talos team confirmed ongoing exploitation of both vulnerabilities by state and criminal actors.
Cybernews

More articles in this cluster (100)

Following this threat?

Track Qilin, Sandworm and Cyclops Blink in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (77)

1 / 4