What happened — quick and slightly terrifying summary

Cisco has confirmed that a critical authentication bypass bug in its Secure Firewall Management Center (FMC) — tracked as CVE-2026-20079 — is being used in live attacks. The flaw carries a CVSS 10.0 rating and allows unauthenticated, remote actors to skip login checks and run commands on affected boxes with full root access.

Technically, the problem stems from a system process created at boot that can be triggered by specially crafted HTTP requests to the FMC web interface. A successful exploit can let attackers execute scripts and commands as the system superuser, which means the device can be fully controlled.

Timeline, clues, and what to do right now

Here’s the timeline boiled down so your coffee doesn’t go cold while you read it:

  • March 2026 — Cisco initially disclosed CVE-2026-20079 and said there was no evidence of exploitation at the time.
  • July 23, 2026 — Example log entries tied to suspicious activity were observed, suggesting earlier exploitation. Administrators were pointed to searches in /var/log/messages for references to /var/tmp/license.tmp as an indicator.
  • July 29, 2026 — Cisco released fixes that also addressed a related issue (static credentials for a low-privileged account, CVE-2026-20316). The same hotfixes were applied for both flaws.
  • August 2026 — Cisco’s PSIRT reported awareness of active exploitation of CVE-2026-20079.
  • September 12, 2026 — The U.S. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by this date.

Key notes: the cloud-hosted Security Cloud Control service has already been patched by Cisco. There are no official workarounds published — only upgrades and hotfixes.

If you manage FMC appliances, prioritize these steps immediately:

  • Upgrade to the latest Cisco Secure FMC release or apply the provided hotfixes without delay.
  • Search /var/log/messages for entries mentioning /var/tmp/license.tmp — finding that entry could indicate possible exploitation.
  • If you discover indicators of compromise, contact Cisco Technical Assistance Center (TAC) for support and follow incident response procedures: isolate affected devices, preserve logs, and assume complete compromise until proven otherwise.
  • Know that installing the hotfix stops future exploitation but does not clean an already backdoored system — forensic analysis and potential rebuilds may be needed.

Final thought: patch fast, hunt your logs, and treat any suspicious FMC behavior like a flaming raccoon in the server room — annoying, dangerous, and best handled immediately.