---
title: "Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass"
url: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/
description: "CVSS 10 auth bypass gives unauthenticated root on on-prem Cisco Secure FMC; exploited by APT and ransomware crews. Upgrade to the hardening releases now."
type: security-brief
section: "Security Digest"
date_published: 2026-03-04
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-20079"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco FMC CVE-2026-20079: Exploited Pre-Auth Root Bypass

**Verdict: Act now.** If you run an on-prem Cisco Secure FMC that is not on a September 2026 hardening release, upgrade now and check it for compromise; state and ransomware actors are using this bug to take root on the box that controls your firewalls.

- **Who must act:** Every organization running on-premises Cisco Secure Firewall Management Center, most urgently where the FMC web interface is reachable from the internet or from broad internal networks.
- **Who can relax:** Customers using only Security Cloud Control Firewall Management (patched by Cisco), and sites that manage firewalls with FDM, ASA or FTD alone, which Cisco lists as not affected.
- **Affected:** Cisco Secure FMC 7.0.x before 7.0.10 (and earlier trains); Cisco Secure FMC 7.2.x before 7.2.12; Cisco Secure FMC 7.4.x before 7.4.8; Cisco Secure FMC 7.6.x before 7.6.6; Cisco Secure FMC 7.7.x before 7.7.13; Cisco Secure FMC 10.0.x before 10.0.2; Cisco Security Cloud Control Firewall Management (SaaS, fixed by Cisco)
- **Fixed:** FMC 7.0.10; FMC 7.2.12; FMC 7.4.8; FMC 7.6.6; FMC 7.7.13; FMC 10.0.2; FMC 10.1.0
- **CVEs:** CVE-2026-20079
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version of every on-prem FMC (show version, or Help > About) and compare it with Cisco's first-fixed table.
2. Upgrade to the hardening release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0); earlier hot fixes are superseded.
3. Remove any internet exposure of the FMC management interface and limit it to an admin network or jump host.
4. Run Cisco's IoC check in expert mode and search for Talos IoCs before and after upgrading.
5. If you find signs of compromise, open a Cisco TAC case, preserve logs, and rotate every credential the FMC holds or can reach.

### How to check if you are affected

- In expert mode run zgrep "package_info.*license" /var/log/messages* and treat any hit referencing /var/tmp/license.tmp as possible exploitation.
- Look for a home.jsp web shell or cmd.jar in the CSM Tomcat webroot and for unexpected scripts in /etc/init.d/, which Talos ties to the intrusions.
- Search network logs for FMC connections to 89.34.96.56, 208.123.119.215, 91.214.78.118 and 43.204.2.142, and load the full Talos IoC list.
- Enable Snort SIDs 66075-66080 (CVE-2026-20079) and 66960-66961 (malware) where your sensors can see FMC traffic.

## What happened

On March 4, 2026, Cisco disclosed [CVE-2026-20079](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2), an authentication bypass in the web interface of Cisco Secure Firewall Management Center (FMC). Cisco says the cause is "an improper system process that is created at boot time." An unauthenticated attacker who sends crafted HTTP requests can run scripts and commands as root on the FMC. Cisco scores it CVSS 3.1 10.0. A Cisco engineer found it during internal testing, and at disclosure there was no sign of attacks.

That changed over the summer. Cisco added indicators of compromise and hot fixes to the advisory on July 31. On September 9, [Cisco Talos](https://blog.talosintelligence.com/fmc-ongoing-exploitation/) reported active exploitation, and CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079) the same day, with a federal deadline of September 12. Cisco's advisory now says its PSIRT "became aware of active exploitation of this vulnerability" in August 2026. On September 16, Cisco replaced the hot fixes with security hardening releases.

Talos describes three intrusion clusters. UAT-12197 used CVE-2026-20079 to plant a JSP web shell and a command-runner JAR, then pulled credentials from internal databases. UAT-11823, which Talos links with high confidence to an APT whose tooling overlaps Sandworm, got in through this bug or through the FMC's static-credential flaw [CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh). It harvested managed-firewall configurations and installed a Cyclops Blink variant. UAT-11988 used the static credentials and went on to deploy Qilin ransomware.

## Who is affected

On-premises Cisco Secure FMC is affected "regardless of device configuration." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-20079) lists releases from 7.0.0 through 7.4.7, 7.6.5, 7.7.12 and 10.0.1. The first fixed releases are 7.0.10 (for 7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. Security Cloud Control (SCC) Firewall Management was also affected, but Cisco patched that SaaS service and says no customer action is required. Firewall Device Manager, ASA, Firepower Threat Defense and the older SCC (formerly Defense Orchestrator) are not affected. Cisco lists no workaround.

## Do you really need to act?

Yes, if you run an on-prem FMC. The bug needs no credentials, scores a 10.0, and is being used by both a state-linked group and a ransomware affiliate. The FMC is also an unusually valuable target. It holds the configuration, policies and often the credentials for every firewall it manages, and Talos saw attackers exfiltrating exactly those configurations. Root on the FMC is close to root on your perimeter.

- **FMC web interface reachable from the internet:** assume it has been probed. Upgrade and hunt for compromise today.
- **FMC on an internal management network:** Cisco notes the attack surface is smaller without public access, but ransomware crews routinely reach internal management planes. Upgrade this week at the latest.
- **Applied the July or August hot fix:** Cisco says those hot fixes only prevent future exploitation and may not address an existing compromise. Move to the hardening release and still run the IoC checks.
- **SCC Firewall Management only, or no FMC:** nothing to do for this CVE.

## What to do now

1. Inventory every FMC and its version. From the FMC CLI, run `show version`, or check Help > About in the web interface.
2. Upgrade to the hardening release for your train: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0. Talos says they bundle the fixes for both exploited FMC CVEs with other internally found bugs.
3. Take the FMC management interface off the internet. Allow it only from an admin VLAN or jump host.
4. Run the IoC check below before and after upgrading. An upgrade does not remove an implant.
5. If anything looks wrong, open a Cisco TAC case, export logs, and rotate the credentials the FMC stores or can reach, including firewall admin, LDAP/AD and RADIUS secrets.

## How to tell if you were hit

Cisco's advisory gives one check. In expert mode, run `zgrep "package_info.*license" /var/log/messages*`. Output that shows `/usr/local/sf/bin/package_info.pl` run against `/var/tmp/license.tmp` means exploitation may have occurred. Talos lists more artifacts: a `home.jsp` web shell and `cmd.jar` in the CSM Tomcat webroot, persistence scripts in `/etc/init.d/`, and outbound connections to `89.34.96.56`, `208.123.119.215`, `91.214.78.118` and `43.204.2.142`. The full hash and IP list is in [Talos's IoC repository](https://github.com/Cisco-Talos/IOCs/tree/main/2026/09). Snort SIDs 66075 to 66080 cover the CVE-2026-20079 exploit, and 66960 and 66961 cover the malware. If an exposed FMC sat unpatched through August and September, treat it as compromised until proven otherwise, and review the managed firewalls for configuration changes too.

## Timeline

- Mar 4, 2026 — Cisco publishes the advisory and fixes, with no known exploitation.
- Jul 29, 2026 — The related static-credential flaw, CVE-2026-20316, is disclosed and added to KEV.
- Jul 31, 2026 — Cisco adds indicators of compromise and hot fixes to the CVE-2026-20079 advisory.
- Sep 9, 2026 — Talos reports active exploitation by three clusters. CISA adds CVE-2026-20079 to KEV, as [Help Net Security](https://www.helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316/) reports.
- Sep 12, 2026 — CISA's remediation deadline for federal agencies.
- Sep 16, 2026 — Cisco notes active exploitation in the advisory and replaces the hot fixes with hardening releases.

## Sources

1. [Cisco — Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2)
2. [Cisco Talos — Active exploitation of Cisco Secure Firewall Management Center vulnerabilities](https://blog.talosintelligence.com/fmc-ongoing-exploitation/)
3. [CVE record — CVE-2026-20079](https://www.cve.org/CVERecord?id=CVE-2026-20079)
4. [NVD — CVE-2026-20079](https://nvd.nist.gov/vuln/detail/CVE-2026-20079)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-20079](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079)
6. [Cisco — Secure FMC static credential vulnerability (CVE-2026-20316)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh)
7. [Cisco Talos — IOCs, September 2026](https://github.com/Cisco-Talos/IOCs/tree/main/2026/09)
8. [Help Net Security — Cisco FMC bugs exploited by nation-state and ransomware actors](https://www.helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316/)

---
Source page: https://erroneo.us/security/briefs/cisco-fmc-cve-2026-20079-auth-bypass-root/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt