Cisco's own July 23 log indicator predates its August date for FMC exploitation
CVE-2026-20079 hands unauthenticated attackers root on Secure Firewall Management Center. CISA wants federal boxes fixed by September 12. The hot fix closes the path but does not evict anyone who already walked it.
The Watch · Security desk
What happened
- Cisco updated its advisory on Wednesday to say Cisco PSIRT became aware of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center, in August 2026.
- The bug comes from an improper system process created at boot time and is triggered by crafted HTTP requests to the device web interface, giving unauthenticated attackers script and command execution as root.
- Cisco first disclosed the vulnerability in March, when it said it had no evidence the flaw was being exploited in attacks.
- CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected systems by September 12, 2026.
- The example compromise indicator Cisco published in July is a log entry dated July 23, weeks earlier than the August window in which Cisco says its product security team learned of exploitation.
Why it matters
- Who's exposed exposure Patching does not clear a box that was already exploited: Cisco says the hot fixes stop future exploitation but do nothing for a device that is already owned, so every FMC with the indicator becomes an incident response and rebuild cost rather than a change ticket.
- What it limits constraint There is no compensating control to buy time with, since Cisco published no workarounds, and operators who cannot take an outage on the management server have nothing to fall back on.
- Who has to decide decision Scoping decisions should be driven by Cisco's own indicator date rather than its confirmation date, which moves the earliest log retention and forensic window back into July.
- What doesn't add up contradiction Cisco confirms exploitation but will not say whether the July 23 activity used both FMC flaws, leaving defenders to decide on their own whether to hunt a two-stage chain or a single bypass.
Next story · Security · yesterday
CISA gives agencies until October 17 to fix four exploited bugs in Cisco, Palo Alto and Ahsay productsConfirmed3 publishers
The indicator Cisco told administrators to hunt for is a sudo record in /var/log/messages: user www, USER=root, running /usr/local/sf/bin/package_info.pl against /var/tmp/license.tmp with --lsm, timestamped Jul 23 16:16:33 [13]. That is the web account executing a Perl utility as root, which is what the advisory's mechanism buys: an improper system process created at boot, reachable by crafted HTTP requests to the management web interface [3]. Cisco's wording for a box carrying that line is that the vulnerability "may have been exploited" [15].
At least nine days separate that timestamp from the earliest date the confirmation can mean [20]. Cisco says PSIRT became aware of active exploitation in August 2026 [2]; the indicator it published in July carries a July 23 date [14]. Anyone scoping dwell time should open the hunt window in July, not in August.
The two-bug question is still open. On July 29 Cisco disclosed CVE-2026-20316, static credentials for a low-privileged FMC account, already exploited, rated High because that access could be combined with other FMC vulnerabilities to elevate privileges [10]. The same indicators went into the CVE-2026-20079 advisory, which at that point did not call the flaw exploited [12], and both advisories shipped identical hot fixes [8]. Asked whether the two were connected, Cisco did not answer directly and pointed customers at the fixes and at TAC [16]. BleepingComputer's reading is that the shared IOCs, the identical hot fixes and the July 23 entry suggest both flaws were used in the same attacks [17]; the latest Cisco update does not say whether the July 23 activity involved both [18]. Read as a chain, the shape is ordinary: static credentials for entry, the bypass for root.
No actor is in the public record. Cisco has not said when the attacks began or who ran them, and it has not described any post-exploitation activity it observed [9].
The upgrade is the only lever. Cisco states there are no workarounds and tells customers to move to the latest release [6]. It has already patched the cloud-hosted Security Cloud Control Firewall Management service; the on-premises Secure FMC software is the customer's work [5]. Federal Civilian Executive Branch agencies have until September 12, 2026 [7], which is 45 days after the hot fixes appeared on July 29 [19]. A CVSS 10.0 unauthenticated root path that was disclosed in March with no evidence of exploitation [1][4] has therefore been an exploited root path for at least six weeks of that patch window.
The last line of Cisco's guidance is the one that costs money: installing the hot fixes prevents future exploitation but does not remediate a device that is already compromised, and customers who find the indicators are told to contact TAC [11].
What to watch
- Whether Cisco ever says if the July 23 activity used CVE-2026-20316, CVE-2026-20079, or both in one intrusion.
- Any named actor or described post-exploitation activity: Cisco has published neither so far.
- Additional IOCs beyond the /var/tmp/license.tmp sudo entry, particularly any dated before July 23.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence74
Perspective Coverage
6 publishers- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-20079 is a maximum-severity authentication bypass in Cisco Secure Firewall Management Center software with a CVSS score of 10.0, allowing unauthenticated remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices.
- [2]
Cisco updated its CVE-2026-20079 advisory on Wednesday to say that in August 2026 Cisco PSIRT became aware of active exploitation of the vulnerability.
- [3]
The flaw is caused by an improper system process created at boot time and can be exploited by sending crafted HTTP requests to the web interface of an affected device.
- [4]
Cisco first disclosed CVE-2026-20079 in March, when it said it had no evidence that the vulnerability was being exploited in attacks.
- [5]
The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management, and Cisco says it has already patched the cloud-hosted Security Cloud Control service.
- [6]
Cisco says there are no workarounds for CVE-2026-20079 and recommends that customers upgrade to the latest software release.
- [7]
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
- [8]
On July 29, 2026 Cisco released software fixes for Secure FMC, and released the same Secure FMC hot fixes for both CVE-2026-20316 and CVE-2026-20079.
- [9]
Cisco did not disclose when the attacks began, who was behind them, or what post-exploitation activity was observed.
- [10]
On July 29 Cisco disclosed CVE-2026-20316, a Secure FMC vulnerability caused by static credentials for a low-privileged account, said it had been actively exploited, and assigned it a High severity rating because the access could be combined with other Secure FMC vulnerabilities to elevate privileges.
- [11]
Cisco advises customers who discover the indicators of compromise to contact its Technical Assistance Center, warning that installing the hot fixes will prevent future exploitation but will not remediate devices already compromised.
- [12]
Cisco updated the CVE-2026-20079 advisory in July to include the same indicators as CVE-2026-20316, but did not confirm at that time that CVE-2026-20079 was exploited.
- [13]
Cisco told administrators to search /var/log/messages for activity related to /var/tmp/license.tmp and shared an example log entry: 'Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm'.
- [14]
The example log entry Cisco published is dated July 23, weeks before Cisco says PSIRT became aware of exploitation of CVE-2026-20079 in August.
- [15]
Cisco says that if the example log entry is found, the vulnerability 'may have been exploited' on the examined Secure FMC device.
- [16]
Asked by BleepingComputer whether the two vulnerabilities were connected, whether CVE-2026-20079 had also been exploited, and whether the shared indicator was added intentionally, Cisco did not answer directly and instead issued a statement urging customers to apply the fixes immediately and to contact Cisco TAC for support.
- [17]
BleepingComputer reports that the same IOCs for both flaws, the identical July hot fixes and the July 23 log entry suggest both vulnerabilities may have been used in the same attacks.
- [18]
Cisco's latest update confirms that CVE-2026-20079 has been exploited but does not clarify whether the July 23 activity included exploitation of both vulnerabilities.
- [19]
There are 45 days between the July 29, 2026 hot fixes and the September 12, 2026 KEV remediation deadline.
- [20]
The July 23 log entry precedes the earliest date covered by Cisco's 'August 2026' awareness statement by at least nine days.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
2 articles · September 10, 2026
- blog.talosintelligence.comActive exploitation of Cisco Secure Firewall Management Center vulnerabilities
1 article · September 9, 2026
- helpnetsecurity.comCisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
1 article · September 10, 2026
- securityaffairs.comAttackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
1 article · September 11, 2026
- securityweek.comOrganizations Warned of Cisco Secure FMC Exploitation
1 article · September 10, 2026
- thehackernews.comCisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
2 articles · September 11, 2026