Vulnerability details
| CVE | Description | CVSS | KEV added |
|---|---|---|---|
| CVE-2026-20079 | FMC web interface authentication bypass, commands as root | 10.0 | 9 Sep 2026 |
| CVE-2026-20316 | FMC static credentials for a low-privileged account | 5.3 | 29 Jul 2026 |
What happened
Cisco first disclosed CVE-2026-20079 in March 2026, when it said it had no evidence of exploitation. The flaw stems from an improper system process created at boot time and lets an unauthenticated, remote attacker send crafted HTTP requests to the FMC web interface to run scripts and commands as root.
On 29 July 2026 Cisco disclosed CVE-2026-20316, a static-credential flaw that was already being exploited, released the same Secure FMC hot fixes for both CVEs, and added the same indicators of compromise to both advisories, without confirming exploitation of CVE-2026-20079 at that point.
On 9 September 2026 Cisco updated the CVE-2026-20079 advisory: "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CISA added the CVE to its Known Exploited Vulnerabilities catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.
How the two FMC flaws relate
Cisco rates CVE-2026-20316 High despite its 5.3 CVSS score because the access it gives "could be combined with other Secure FMC vulnerabilities to elevate privileges". Cisco has not said which flaws, and it has not said whether the July activity it described involved both CVEs.
Cisco Talos described three intrusion clusters in September, as reported by Help Net Security: one exploited CVE-2026-20079, one gained access through either flaw and is believed to be the work of Sandworm, and one used CVE-2026-20316 and is suspected to be a Qilin ransomware operator. Talos did not describe the two CVEs as a single chain.
Affected versions and patching
According to runZero, the March fixed releases for CVE-2026-20079 are 7.0.9, 7.2.11, 7.4.4, 7.6.4 and 7.7.12; FMC 6.4.0.13 to 6.4.0.18 should move to 7.0.9 or later.
Cisco says there are no workarounds. It recommends applying the hot fixes released on 29 July for the affected branch or upgrading to the latest release. Hot fixes prevent future exploitation but do not remediate a device that is already compromised. Talos said a broader hardening release, bundling those hot fixes with other internally found vulnerabilities, was scheduled for the week of 16 September. Keeping the FMC management interface off the internet reduces exposure.
Checking for compromise
Cisco told administrators to search /var/log/messages for activity involving /var/tmp/license.tmp, for example:
cat /var/log/messages | grep license
Cisco's example entry shows the web process (user www) running package_info.pl as root against /var/tmp/license.tmp. Cisco says a matching entry means the vulnerability "may have been exploited" on that device. If it is found, rotate all user credentials, keys and certificates on the FMC and contact Cisco TAC.
Key points
- CVE-2026-20079 is a CVSS 10.0 authentication bypass in the Cisco Secure FMC web interface that gives an unauthenticated remote attacker root.
- Cisco PSIRT became aware of exploitation in August 2026 and confirmed it in an advisory update on 9 September 2026.
- CISA added the CVE to KEV on 9 September 2026, with a 12 September due date for federal civilian agencies.
- CVE-2026-20316 shares the same hot fixes and log indicator; Cisco has not confirmed the two were chained.
- There are no workarounds: apply the hot fixes or upgrade, and check logs for
/var/tmp/license.tmpactivity.
Further reading & sources
- Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks (BleepingComputer)
- Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) (Help Net Security)
- Cisco warns of FMC static credential flaw exploited in zero-day attacks (BleepingComputer)
- Cisco warns of max severity Secure FMC flaws giving root access (BleepingComputer)
- Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets (runZero)