Cisco FMC CVE-2026-20079: patched in March, exploited now

Cisco Talos confirmed active exploitation of CVE-2026-20079 on September 9, a CVSS 10.0 authentication bypass in Secure Firewall Management Center that hands an unauthenticated remote attacker root on the box that manages your firewalls. Cisco published the advisory and the fix on March 4. Six months later, attackers are still finding unpatched instances — and three separate groups are working them.

What actually happened

The bug is a boot-time accident. On FMC startup the system creates a csm_processes session in its database with a static session ID instead of a dynamic UUID, per VulnCheck's analysis. If nobody authenticates to the web UI after boot, that session sits there waiting to be upgraded into usable permissions. The fix was roughly 25 lines. The exposure window is worst on exactly the appliances nobody logs into.

Talos documented three distinct clusters working the same door:

• UAT-12197 dropped JSP web shells and JAR-based command executors, then pulled authentication credentials out of the internal databases.
• UAT-11823, linked to Sandworm, opened reverse shells to its own command-and-control server and deployed Cyclops Blink — persistence, DNS-over-HTTPS resolution, credential harvesting, network scanning.
• UAT-11988 used static credentials for access, stood up SOCKS proxies and reverse-SSH tunnels, then deployed Qilin ransomware.

Attackers are also chaining CVE-2026-20079 with CVE-2026-20316, the static-credential FMC flaw we covered in July. Hotfixes for both are out now; Cisco scheduled a fuller hardening release for the week of September 14.

Why a six-month-old patch matters for your business

Nothing here is a zero-day. The fix existed in March. Every organization in the Talos telemetry had half a year and did not apply it — because a firewall manager is infrastructure nobody touches, and things nobody touches do not generate patch tickets.

That is the actual failure mode for small teams. Your laptops update themselves. Your web app has a deploy pipeline. The appliance in the rack, the NAS, the VPN concentrator, the management console — those get patched when someone remembers, which is never.

Three things to do this week. Inventory the boxes with a web UI you have not logged into since installation, and check every one against CISA's Known Exploited Vulnerabilities catalog. Take management interfaces off any network a random host can reach — an auth bypass you cannot route to is not an incident. And accept that the credentials on a compromised FMC are gone: rotate them, do not just patch and move on.

If your firewall manager was internet-reachable and unpatched since March, treat this as a breach investigation, not a maintenance window.

Sources: Cisco Talos, VulnCheck, BleepingComputer.