[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUkMmXCJeFVZ51G_JKUW40H4W9ufLjhrQvbGhEp95xzY":3,"$fObkkbSfwI9djl-YPmrY-MoLS8Ff-8t9SBoiNefnxLtg":88},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":84,"created_at":85,"updated_at":86,"published_at":87},"cisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild","Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild","CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV on 9 September 2026.","Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.",[10,11,12,13,14],"Cisco","CVE-2026-20079","FMC","CISA KEV","auth-bypass","# Cisco confirms FMC auth-bypass CVE-2026-20079 exploited in the wild\n\n*CVSS 10.0 flaw in Cisco Secure FMC web interface gives unauthenticated attackers root; CISA added it to KEV on 9 September 2026.*\n\n**Tags:** `Cisco` `CVE-2026-20079` `FMC` `CISA KEV` `auth-bypass`\n\n> Cisco updated its advisory for CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center, on 9 September 2026 to confirm active exploitation that its PSIRT became aware of in August. CISA added the CVE to its KEV catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.\n\n---\n\n## Vulnerability details\n\n| CVE | Description | CVSS | KEV added |\n|---|---|---|---|\n| CVE-2026-20079 | FMC web interface authentication bypass, commands as root | 10.0 | 9 Sep 2026 |\n| CVE-2026-20316 | FMC static credentials for a low-privileged account | 5.3 | 29 Jul 2026 |\n\n## What happened\n\nCisco first disclosed CVE-2026-20079 in March 2026, when it said it had no evidence of exploitation. The flaw stems from an improper system process created at boot time and lets an unauthenticated, remote attacker send crafted HTTP requests to the FMC web interface to run scripts and commands as root.\n\nOn 29 July 2026 Cisco disclosed CVE-2026-20316, a static-credential flaw that was already being exploited, released the same Secure FMC hot fixes for both CVEs, and added the same indicators of compromise to both advisories, without confirming exploitation of CVE-2026-20079 at that point.\n\nOn 9 September 2026 Cisco updated the CVE-2026-20079 advisory: \"In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.\" CISA added the CVE to its Known Exploited Vulnerabilities catalogue the same day, with a 12 September 2026 due date for federal civilian agencies.\n\n## How the two FMC flaws relate\n\nCisco rates CVE-2026-20316 High despite its 5.3 CVSS score because the access it gives \"could be combined with other Secure FMC vulnerabilities to elevate privileges\". Cisco has not said which flaws, and it has not said whether the July activity it described involved both CVEs.\n\nCisco Talos described three intrusion clusters in September, as reported by Help Net Security: one exploited CVE-2026-20079, one gained access through either flaw and is believed to be the work of Sandworm, and one used CVE-2026-20316 and is suspected to be a Qilin ransomware operator. Talos did not describe the two CVEs as a single chain.\n\n## Affected versions and patching\n\nAccording to runZero, the March fixed releases for CVE-2026-20079 are 7.0.9, 7.2.11, 7.4.4, 7.6.4 and 7.7.12; FMC 6.4.0.13 to 6.4.0.18 should move to 7.0.9 or later.\n\nCisco says there are no workarounds. It recommends applying the hot fixes released on 29 July for the affected branch or upgrading to the latest release. Hot fixes prevent future exploitation but do not remediate a device that is already compromised. Talos said a broader hardening release, bundling those hot fixes with other internally found vulnerabilities, was scheduled for the week of 16 September. Keeping the FMC management interface off the internet reduces exposure.\n\n## Checking for compromise\n\nCisco told administrators to search `\u002Fvar\u002Flog\u002Fmessages` for activity involving `\u002Fvar\u002Ftmp\u002Flicense.tmp`, for example:\n\n```\ncat \u002Fvar\u002Flog\u002Fmessages | grep license\n```\n\nCisco's example entry shows the web process (user `www`) running `package_info.pl` as root against `\u002Fvar\u002Ftmp\u002Flicense.tmp`. Cisco says a matching entry means the vulnerability \"may have been exploited\" on that device. If it is found, rotate all user credentials, keys and certificates on the FMC and contact Cisco TAC.\n\n## Key points\n\n- CVE-2026-20079 is a CVSS 10.0 authentication bypass in the Cisco Secure FMC web interface that gives an unauthenticated remote attacker root.\n- Cisco PSIRT became aware of exploitation in August 2026 and confirmed it in an advisory update on 9 September 2026.\n- CISA added the CVE to KEV on 9 September 2026, with a 12 September due date for federal civilian agencies.\n- CVE-2026-20316 shares the same hot fixes and log indicator; Cisco has not confirmed the two were chained.\n- There are no workarounds: apply the hot fixes or upgrade, and check logs for `\u002Fvar\u002Ftmp\u002Flicense.tmp` activity.\n\n## Further reading & sources\n\n- [Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks\u002F) (BleepingComputer)\n- [Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F09\u002F10\u002Fcisco-fmc-exploited-cve-2026-20079-cve-2026-20316\u002F) (Help Net Security)\n- [Cisco warns of FMC static credential flaw exploited in zero-day attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks\u002F) (BleepingComputer)\n- [Cisco warns of max severity Secure FMC flaws giving root access](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access\u002F) (BleepingComputer)\n- [Cisco Secure FMC vulnerability CVE-2026-20316: Find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fcisco-secure-fmc) (runZero)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-confirms-fmc-auth-bypass-cve-2026-20079-exploited-in-the-wild.png?v=e25c4c61c3",{"cves":18,"iocs":40,"malware":44,"timeline":49,"technologies":75},[19,27,32],{"id":11,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-20079",10,0.8818,"Critical",89.89,"3.1",{"id":28,"kev":20,"poc":20,"url":29,"cvss":22,"epss":30,"risk_band":24,"risk_score":31,"cvss_version":26},"CVE-2026-20131","\u002Fvulnerabilities\u002FCVE-2026-20131",0.4317,87,{"id":33,"kev":20,"poc":34,"url":35,"cvss":36,"epss":37,"risk_band":38,"risk_score":39,"cvss_version":26},"CVE-2026-20316",false,"\u002Fvulnerabilities\u002FCVE-2026-20316",5.3,0.351,"High",74.11,[41],{"type":42,"value":43},"other","\u002Fvar\u002Ftmp\u002Flicense.tmp",[45,47],{"name":46},"license.tmp",{"name":48},"Ransomware",[50,54,57,60,64,67,71],{"date":51,"event":52,"description":53},"2026-03","Disclosure","CVE-2026-20079 fixed \u002F disclosed in early March 2026",{"date":51,"event":55,"description":56},"Advisory","Rapid Response issued for CVE-2026-20079",{"date":58,"event":55,"description":59},"2026-03-04","Cisco released security updates to patch two maximum-severity vulnerabilities in Secure FMC",{"date":61,"event":62,"description":63},"2026-07","Exploited in wild","Cisco confirmed CVE-2026-20316 had been exploited by attackers",{"date":65,"event":52,"description":66},"2026-07-29","CVE-2026-20316 disclosed with a fix made available",{"date":68,"event":69,"description":70},"2026-08","Exploitation","Cisco PSIRT became aware of active exploitation",{"date":72,"event":73,"description":74},"2026-09-09","Confirmation","Cisco confirmed active exploitation",[76,78,80,82],{"vendor":10,"product":77},"Secure Firewall Management Center (FMC)",{"vendor":10,"product":79},"Secure FMC Software",{"vendor":10,"product":81},"Secure FMC",{"vendor":10,"product":83},"Security Cloud Control (SCC) Firewall Management","vulnerability_disclosure","2026-09-12T07:10:09.180903+00:00","2026-10-16T12:28:44.165612+00:00",null,{"articles":89},[90,102,113,124],{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":84,"created_at":101},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[95,96,97,98,13,99],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00",{"slug":103,"title":104,"summary":105,"tags":106,"hero_image_url":111,"story_type":84,"created_at":112},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[107,108,13,109,110],"CVE-2026-18556","N-Able N-Central","RCE","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":114,"title":115,"summary":116,"tags":117,"hero_image_url":121,"story_type":122,"created_at":123},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[118,119,109,13,120],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":125,"title":126,"summary":127,"tags":128,"hero_image_url":135,"story_type":84,"created_at":136},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.",[129,130,131,132,133,134],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00"]