Cisco Confirms Critical FMC Authentication Bypass Is Actively Exploited

Cisco first disclosed CVE-2026-20079 on 4 March 2026 and updated its advisory on 9 September after confirming that its incident-response organisation had observed active exploitation in August.

Secure Firewall Management Center centrally administers firewall policies, software updates, events, and operational settings. Root access to the appliance can expose configuration and telemetry, enable tampering, and create a path toward systems that trust the management platform.

Cisco says the flaw resides in FMC management software. Secure Firewall Threat Defense, Adaptive Security Appliance software, and Firewall Device Manager are not affected by this specific vulnerability.

• Public exposure increases urgency, but internal reachability still matters after another foothold is gained.
• Management access should be restricted to authorised administrative networks and jump hosts.
• Connected device configurations and policy history become part of the investigation if FMC is compromised.
• Credentials, API keys, and certificates accessible to the appliance may require rotation.

Cisco advises defenders to search the appliance message logs for activity involving its package_info process and a licence-related temporary file.

zgrep "package_info.*license" /var/log/messages*

An entry involving /usr/local/sf/bin/package_info.pl processing /var/tmp/license.tmp as root should trigger immediate escalation in the documented context.

1. 1

   Find every FMC instance. Include appliances behind VPNs, administrative jump paths, partner access, cloud networks, and disaster-recovery environments.

2. 2

   Establish exposure. Record software release, interface reachability, access controls, patch state, and how long the appliance was vulnerable.

3. 3

   Preserve evidence. Collect logs, configuration, process and file evidence, administrative activity, and outbound connections before changes overwrite them.

4. 4

   Apply the fixed release or hot fix. Use Cisco's current advisory and Software Checker for the exact appliance release.

5. 5

   Escalate suspected compromise. Cisco directs affected customers to contact TAC. Do not return the system to service merely because the hot fix installed successfully.

6. 6

   Expand the investigation. Review policies, administrator accounts, scheduled activity, unexpected files, credentials, connected devices, and destinations contacted by the appliance.

7. 7

   Recover from trust. Where required, rebuild or restore from a known-good state and compare current firewall policy with trusted backups and change records.

Cisco explicitly warns that the hot fixes prevent future exploitation and may not address an existing compromise. Patching closes the entry point; it does not reverse commands, remove persistence, restore altered configuration, or invalidate stolen secrets.

That distinction is the centre of the response. If the appliance was reachable while vulnerable—especially during confirmed exploitation—combine remediation with threat hunting and recovery planning.

CVE-2026-20079 combines unauthenticated network access, low attack complexity, root-level impact, no complete workaround, and confirmed exploitation. For affected FMC deployments, it belongs at the front of both the patch queue and the investigation queue.