Cisco Talos confirmed active in-the-wild exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC), headlined by a maximum-severity authentication bypass tracked as CVE-2026-20079 (CVSS 10.0, CWE-288). The flaw stems from improper system process initialization during boot, allowing unauthenticated remote adversaries to send crafted HTTP requests to the web interface and execute arbitrary commands with root privileges. Attackers have also paired this bypass with CVE-2026-20316 (CVSS 5.3), a static credential vulnerability, to maintain low-privilege footholds and validate access paths.

Telemetry revealed three threat clusters—tracked as UAT-12197, UAT-11823, and UAT-11988—compromising exposed FMC gateways to establish reverse proxy tunnels, deploy web shells, exfiltrate credentials, and deliver Qilin ransomware and Cyclops Blink malware. Forensic artifacts center on unauthorized package_info.pl executions by the www daemon and tampering with /var/tmp/license.tmp. CISA has added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog with an emergency remediation mandate, and Cisco urged administrators to apply released hotfixes immediately, as no software workarounds exist.

Why it matters:

• Centralized management plane compromise: Gaining unauthenticated root access to FMC exposes the orchestration backbone of enterprise firewall infrastructure, allowing adversaries to silently reconfigure access policies, disable perimeter inspection, and pivot unchecked into segmented internal network enclaves.
• Immediate edge isolation and forensic triage: Because no mitigations exist, security teams must immediately restrict FMC web access to internal management VLANs, apply emergency hotfixes, and inspect /var/log/messages for rogue /var/tmp/license.tmp entries to detect pre-patch compromise.