Cisco Secure Firewall Management Center (versions prior to patched releases)

The software fails to properly verify a user's identity before allowing access to privileged functions. An attacker can interact with authenticated endpoints without presenting valid credentials, because the application's authentication logic does not enforce the check at the point of execution.

An attacker sends a crafted request directly to the FMC interface without logging in. The application processes the request as though it came from an authorised user, allowing the attacker to execute scripts and establish root-level access. From there, observed post-exploitation activity includes deploying web shells (persistent backdoors hidden in web server files), harvesting stored credentials, and in one confirmed case, deploying a variant of the Cyclops Blink malware previously linked to Russian state actors.

A second related vulnerability, CVE-2026-20316 (CVSS 5.3, Medium), has been used alongside this flaw to further elevate attacker privileges — patch that one too.

Look for unexpected processes or unfamiliar JAR files in your Tomcat webroot directory. Review authentication logs for access to privileged endpoints from unauthenticated sessions. Monitor for outbound connections to unusual external IP addresses initiated by the FMC process.

1. Apply Cisco's available hotfix for CVE-2026-20079 immediately — do not wait for the comprehensive hardening release scheduled for the week of 14 September.
2. Restrict FMC management interface access to trusted IP ranges only.
3. Review FMC access logs for signs of compromise before and after patching.