Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

If you manage Cisco firewalls through an on-prem FMC, patch it now

A critical, unauthenticated flaw in Cisco Secure Firewall Management Center gives root access with no login. It's under active exploitation and in CISA's KEV catalog.

If your organization manages Cisco firewalls through your own on-premises Secure Firewall Management Center (FMC) — not Cisco’s cloud-delivered management — there’s a critical flaw you need to check today. Cisco confirmed in-the-wild exploitation of an authentication bypass in FMC’s web interface, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on September 9, 2026. The fix has actually been available since March 2026; the urgency now is that attackers only started using it in earnest over the summer, which means anyone who put off that update is an easy target.

This affects FMC itself, the management platform, not every Cisco firewall. If your firewalls are managed individually or through Cisco’s SaaS-based Security Cloud Control, this specific issue doesn’t apply to you — Cisco has already patched that cloud offering and says no customer action is needed there.

What’s vulnerable

The flaw is tracked as CVE-2026-20079, with a maximum CVSS score of 10.0. It stems from a system process that FMC creates improperly at boot time. An unauthenticated remote attacker can send crafted HTTP requests to the FMC web interface and use that flawed process to run scripts as root on the underlying operating system — no credentials needed, no user interaction required.

On-premises FMC releases across the 6.4 through 7.7 lines, plus the 10.0 branch, are affected. Cisco’s advisory lists fixed builds by branch: 7.0.9, 7.2.11, 7.4.4, 7.6.4, and 7.7.12 or later, along with earlier hotfixes for some branches. Because the exact fixed build and hotfix name depend on which release you’re currently running, use Cisco’s own Software Checker or your TAC contract to confirm the right target for your version rather than guessing from a general list.

Cisco has also disclosed a second, related flaw in the same product: CVE-2026-20316, a static-credential issue (CVSS 8.9) that lets a remote attacker log in to the FMC web interface with a built-in, low-privileged account baked into the software. Cisco disclosed that one in late July 2026, and CISA added it to KEV around the same time, ahead of the authentication-bypass issue. If you haven’t patched FMC since before this summer, treat both as live and confirm you’re past the fixed builds for each.

Cisco says there’s no workaround for CVE-2026-20079 short of upgrading. If your FMC’s web interface is reachable from the internet, taking it off the public internet reduces the attack surface in the meantime, but it isn’t a substitute for the update.

What to do

  1. Confirm whether you run on-premises FMC, and if so, which version. If an MSP or VAR manages your Cisco firewalls, ask them directly whether your management platform is affected and when it will be patched — don’t assume it’s already handled.
  2. Update to the fixed release for your branch. There’s no supported workaround, so the update is the fix, not a stopgap.
  3. Get the FMC management interface off the public internet if it’s currently reachable there, regardless of patch status. A management interface for your firewalls has no business being open to the world.
  4. Ask about an indicator-of-compromise review if your FMC was internet-facing before you patched. Given that exploitation has been active since August, don’t assume a clean-looking system was never touched — Cisco’s advisory and TAC can walk through what to check.

Why this matters here

A firewall management platform is about as high-value a target as it gets: whoever controls it can see and potentially reconfigure every firewall it manages. Cisco gear shows up in county and municipal networks and in community bank environments, often installed years ago by a contractor and left to run quietly. That’s exactly the kind of system that misses a Patch Tuesday-style update cycle, because nobody has “patch the firewall manager” on a recurring calendar reminder. If you’re doing a broader sweep of internet-facing management interfaces while you’re at it, the same principle applies to SonicWall’s recent SMA1000 vulnerabilities: anything that manages or grants access to your network perimeter needs to be off the public internet by default, patched on a schedule, and checked, not assumed safe because nothing looks wrong today.

Sources

All articles