CVE-2026-20079: CVSS 10.0 Cisco FMC Auth Bypass Tied to Sandworm and Qilin Ransomware
A perfect 10.0 severity flaw in Cisco Secure Firewall Management Center is under active exploitation, tied by Cisco Talos to intrusion clusters including Sandworm and Qilin ransomware activity, and there is no workaround. If your organization runs FMC and has not patched, this is not a maintenance window item, it is a today item.
Quick guide
- Identify every Cisco Secure Firewall Management Center appliance in your environment, including any exposed to the internet or a less trusted network.
- Check the software version against Cisco’s security advisory for CVE-2026-20079 to see if your build is affected.
- If affected, apply Cisco’s fixed release immediately. There is no configuration workaround for this vulnerability.
- Until patched, restrict access to the FMC web interface to trusted management networks only, using an access control list or a jump host, since the flaw is exploited unauthenticated over HTTP.
- Review FMC and firewall logs for signs of unexpected root level activity or unfamiliar processes, given the confirmed exploitation activity.
- If you manage a fleet under a compliance deadline, note that CISA added this to its Known Exploited Vulnerabilities catalog with a short remediation window, already passed for federal agencies.
What the vulnerability actually is
Cisco’s own advisory describes CVE-2026-20079 as a flaw in the web interface of Cisco Secure Firewall Management Center software that allows an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device, gaining root access to the underlying operating system. The root cause is an improper system process created at boot time. NVD lists a maximum CVSS base score of 10.0, the highest possible rating, and the entry was published in early March 2026 before being formally added to CISA’s Known Exploited Vulnerabilities catalog on September 9, 2026, with a remediation due date of September 12, 2026.
Confirmed active exploitation
Cisco has confirmed active exploitation of this vulnerability. Reporting on the advisory states that Cisco Talos has associated exploitation activity with multiple intrusion clusters, including activity linked to Sandworm, a threat actor publicly attributed to Russian military intelligence, and to Qilin ransomware operations. A CVSS 10.0 authentication bypass leading to root, already tied to ransomware activity, is about as severe as a network security appliance vulnerability gets.
Why FMC specifically matters
Firewall Management Center is the central console that configures and monitors Cisco’s Secure Firewall (formerly Firepower) devices across an environment. Root access on the FMC host does not just compromise one appliance, it can expose the credentials and configuration used to manage every firewall that FMC controls, making this a path to broader network compromise rather than an isolated device issue.
What actually goes wrong
Security teams sometimes treat management consoles as lower priority than the internet facing devices they manage, on the assumption that the console itself sits on an internal network. This vulnerability does not require prior access, only network reachability to the FMC web interface, which makes exposure broader than teams often assume, especially with remote management, MSSP access, or flat internal networks. Confirmed nation state and ransomware activity against this specific flaw removes any argument for treating it as low priority.
FAQ
Is there a workaround if I cannot patch immediately?
Cisco states no workaround exists for this vulnerability. The only real mitigation is restricting network access to the FMC web interface while you prepare to patch, and patching remains the actual fix.
How do I know if my FMC has already been exploited?
Review FMC logs and host level activity for unexpected processes or accounts, and consider engaging incident response support if you find any FMC exposed to less trusted networks and have not yet confirmed your patch level.
Does this affect the firewalls themselves or only FMC?
The vulnerability is in the Firewall Management Center software specifically. Its severity comes partly from FMC’s role managing multiple firewalls, meaning a compromised FMC can affect the security of everything it manages.
Sources
NVD entry for CVE-2026-20079, the CISA Known Exploited Vulnerabilities catalog, and Cisco’s security advisory for this flaw.
