Cisco FMC login bypass CVE-2026-20079 exploited for credential theft and backdoors; fixes available
Attackers used CVE-2026-20079 to take over Cisco firewall-management servers without logging in. Ask your business or family office’s IT provider to update FMC and check for intruders. Cisco has already patched SCC Firewall Management.
If your business or family office uses FMC, ask its IT provider to install the matching Cisco hardening release listed below and check for compromise. Suspected intrusions need Cisco TAC recovery guidance because updating alone may leave an existing compromise unresolved. Cisco has already updated SCC Firewall Management; its users have no patch to install.
What’s happening
CVE-2026-20079 lets an attacker who can reach Cisco Secure Firewall Management Center’s web interface take full control without logging in. It also affected SCC Firewall Management, which Cisco has patched centrally. Cisco disclosed the flaw in March and later confirmed exploitation; Talos documented credential theft and backdoor installation. The exact start of attacks is not established. By 16 September, Cisco had published hardening releases covering every listed FMC branch. There is no workaround, and installing a fix may not remove an existing compromise. Cisco explicitly excludes ASA and FTD software from this particular flaw.
- What
- Flaw
- Affects
- Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management
- Affected
- Cisco Secure FMC Software, regardless of configuration; Cisco’s release table covers 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1. Earlier hot-fix builds also existed; check the exact build with Cisco.
Cisco SCC Firewall Management, regardless of configuration; Cisco has deployed the fix to its cloud environments. - Fixed in
- Cisco Secure FMC 7.0.10
Cisco Secure FMC 7.2.12
Cisco Secure FMC 7.4.8
Cisco Secure FMC 7.6.6
Cisco Secure FMC 7.7.13
Cisco Secure FMC 10.0.2
Cisco Secure FMC 10.1.0
Cisco SCC Firewall Management: fix deployed by Cisco; no customer update required. - Since
- 9 Sept 2026
- Closed
- 16 Sept 2026
Timeline
- New fixFixed
Cisco replaced its hot-fix guidance with published hardening releases: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. These include the authentication-bypass fix and other security improvements.
- Wider attacks
Cisco Talos documented two attack clusters exploiting CVE-2026-20079, involving stolen credentials, backdoors and Cyclops Blink malware. Its separate Qilin ransomware case used the static-credential flaw CVE-2026-20316.
- CISA added
CISA added CVE-2026-20079 to its exploited-vulnerability catalogue, setting a 12 September remediation deadline for US federal civilian agencies. BleepingComputer reported Cisco had become aware of exploitation in August.
- Vendor revised
Cisco’s revision history records additional hot fixes and compromise indicators. It advised customers to contact Cisco TAC if intrusion was suspected.
- Made public
Cisco disclosed CVE-2026-20079, a critical FMC web-interface flaw allowing remote attackers to gain full system control without signing in.
Sources
- Cisco Secure Firewall Management Center Software Authentication Bypass VulnerabilityCisco · 16 Sept 2026
- Cisco Secure Firewall ASA, FTD and FMC Software Hardening Release: September 2026Cisco · 18 Sept 2026
- Active exploitation of Cisco Secure Firewall Management Center vulnerabilitiesCisco Talos · 9 Sept 2026
- Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacksBleepingComputer · 9 Sept 2026
- Cisco FMC flaws exploited by ransomware gang, state-sponsored hackersBleepingComputer · 10 Sept 2026