Cisco FMC CVE-2026-20079 Hit CISA’s List — Patch Before Qilin Does

If your office runs Cisco Secure Firewall gear, the box that manages those firewalls just became the story. Cisco Talos confirmed this week that three separate threat clusters — including a Qilin ransomware crew — have been abusing flaws in Secure Firewall Management Center (FMC). The loudest one, CVE-2026-20079, is a CVSS 10.0 authentication bypass that can hand an unauthenticated attacker root on the management appliance. CISA put it on the Known Exploited Vulnerabilities (KEV) catalog on September 9, 2026, with a federal remediation due date of September 12, 2026. For NYC SMBs that treat the firewall stack as “already handled,” that is a same-week check, not a quarterly project.

What CVE-2026-20079 and CVE-2026-20316 actually are

Per Cisco’s advisory for cisco-sa-onprem-fmc-authbypass-5JPp45V2, CVE-2026-20079 lives in the FMC web interface. An improper system process created at boot time lets a remote, unauthenticated attacker send crafted HTTP requests, bypass authentication, execute scripts, and obtain root on the underlying OS. NVD and Cisco both score it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Cisco first disclosed it in the March 2026 security bundle; the advisory’s September 9, 2026 revision states Cisco PSIRT became aware of active exploitation in August 2026.

The second flaw in the same news cycle is CVE-2026-20316, covered by cisco-sa-fmc-static-cred-BET3Cjh. It is a use-of-hard-coded-password issue: static credentials for a low-privileged account that let an unauthenticated attacker log in and read sensitive data. CVSS base is 5.3, but Cisco rates the Security Impact Rating High because the foothold can be chained with other FMC flaws for privilege escalation. CISA added CVE-2026-20316 to KEV on July 29, 2026, and the live KEV JSON marks knownRansomwareCampaignUse as Known.

Important scope note from Cisco: Firewall Device Manager (FDM), Secure Firewall ASA, Secure Firewall Threat Defense (FTD), and Security Cloud Control (SCC) generally are not the same as on-prem FMC for this pair. SCC Firewall Management (the SaaS management offering named in the auth-bypass advisory) was patched by Cisco with no customer action required. On-prem FMC is where your team still has homework.

Why an FMC compromise is worse than “one firewall got weird”

FMC is the control plane for many Secure Firewall deployments. Compromise it and you are not arguing about a single branch office edge device. You are arguing about managed-device configs, credentials, policy push rights, and a privileged view into the rest of the estate. That is the same structural risk class as other management-plane KEVs we have covered — for example the N-central Hotfix 4 / CVE-2026-86218 story and the SonicWall SMA1000 KEV edge appliance case. Different products, same lesson: tools that manage many networks become the network.

For a Staten Island or Midtown firm that co-lo’s a pair of Firepower appliances and trusts a shared FMC VM, “we’ll patch next maintenance window” is how ransomware operators buy time. Talos’s reporting makes that concrete.

What Cisco Talos actually observed (three clusters)

Coverage from The Hacker News (September 11, 2026) and Help Net Security (September 10, 2026), summarizing Cisco Talos, describes three post-compromise clusters:

• UAT-12197 — exploited CVE-2026-20079 to drop a JSP web shell and a JAR-based command executor used to query internal databases and pull authentication data / credentials.
• UAT-11823 — used both CVE-2026-20079 and CVE-2026-20316; delivered a Netcat-style reverse shell, bash scripts that harvest managed-device configurations, and a Cyclops Blink–family implant previously associated with the Russian state-sponsored group Sandworm.
• UAT-11988 — assessed as a ransomware operation consistent with Qilin affiliates. Initial access via the static credentials in CVE-2026-20316, then living-off-the-land abuse of built-in FMC tooling: reconnaissance, credential collection, SOCKS/reverse-SSH style tunneling toward domain services, AV killers, and Qilin ransomware on selected endpoints.

We are not repeating exploit recipes here. The operational takeaway for an NYC ops lead is simpler: if your FMC management interface was reachable from places it should not have been, assume triage — not vibes.

What to do this week (no drama, just the list)

1. Identify every FMC. On-prem appliances and VMs. Note the software train (7.0 / 7.2 / 7.4 / 7.6 / 7.7 / 10.0). Ask your MSP or internal network owner in writing.
2. Apply Cisco’s release-specific hotfixes listed in the auth-bypass advisory (and mirrored for the static-cred advisory). Examples Cisco published include Hotfix packages such as GB-7.0.9.1-3, HL-7.2.11.1-4, HG-7.4.7.1-3, CY-7.6.5.1-2, AM-7.7.12.1-2, and P-10.0.1.1-2. Download only from Cisco’s Software Center / advisory links — not random mirrors.
3. Cut exposure while you patch. Both Cisco advisories note that keeping the FMC management interface off the public internet reduces the attack surface. That is mitigation, not a cure. Patching is still required. There are no workarounds that fully address either CVE.
4. Look for Cisco’s published IoCs — carefully. Cisco documents a log check involving package_info.pl and /var/tmp/license.tmp in expert mode. If that pattern shows up, contact Cisco TAC for recovery guidance. Cisco also recommends rotating user credentials, keys, and certificates on a suspected-compromised FMC. Do not treat a clean grep as proof of innocence if the box was internet-exposed for months.
5. Remember BOD 26-04’s spirit even if you are not federal. CISA’s KEV entry for CVE-2026-20079 requires covered agencies to apply vendor mitigations by September 12, 2026, and calls out forensic triage expectations for high-impact KEVs. Private SMBs are not under BOD 26-04, but the due date is a useful urgency signal: this is not theoretical.
6. Plan for Cisco’s hardening drop. Talos / Cisco messaging around the September 10–11 reporting said a broader hardening release covering additional internally found issues was expected the week of September 16, 2026. Install the current hotfixes now; treat the later bundle as follow-through, not an excuse to wait.

Questions NYC owners should ask their MSP today

• Which FMC build are we on, and which hotfix filename is installed?
• Is the FMC management interface reachable from the internet, a partner VPN, or only a jump host?
• Who owns the change window if we need an emergency hotfix tonight?
• If IoCs fire, who dials Cisco TAC, and who rotates secrets?
• Are we conflating FTD/ASA patching with FMC patching? (Different products.)

If the answers are fuzzy, that is the finding. Fuzzy inventory is how Qilin-style operators stay quiet until encryption day.

A practical NYC exposure pattern we keep seeing

Plenty of small professional firms in Manhattan, Brooklyn, and Staten Island still put the FMC web UI on a public IP “temporarily” so a consultant can finish a policy push, then forget to lock it back down. Others forward 443 from a cheap cloud firewall to an aging FMC VM in a closet. Either pattern turns CVE-2026-20079 from a patch ticket into an incident ticket.

If you outsource firewall changes, ask for a screenshot or CLI output of the installed hotfix name — not a verbal “we’re current.” Cisco’s fixed-software table is release-specific; “7.4 something” is not the same as HG-7.4.7.1-3. Same discipline applies if you use a co-managed model: your internal IT owns the change calendar, your MSP owns the hands-on, and neither party gets to assume the other already applied Hotfix P / AM / CY / HG / HL / GB.

Also separate sensor patching from manager patching. Updating FTD on the edge does not auto-heal an unpatched FMC. Cisco’s affected-product notes make that split explicit. Treat them as two workstreams on the same change board.

What this is not

This is not a claim that every NYC Cisco shop is already encrypted. We are not inventing infection counts or dollar losses. Cisco’s own advisories and Talos cluster notes are enough: active exploitation, ransomware linkage on the static-credential path, and a CVSS 10.0 management-plane bypass on KEV with a September 12 federal clock. That is the bar.

It is also not a reason to rip out Secure Firewall in a panic. It is a reason to treat the management plane with the same urgency you already give public-facing VPN appliances.

How MicroSky helps

MicroSky Managed Services works with NYC and Staten Island SMBs that need someone to inventory the firewall management stack, apply vendor hotfixes without tribal knowledge theater, and verify the management UI is not hanging out on the open internet. If you are mid-incident, we coordinate triage and vendor escalation — we do not publish exploit how-tos on the blog.

Need a same-day FMC version and exposure check? Call (718) 672-2177 or visit microskyms.com.

Sources

• Cisco PSIRT — Secure FMC Authentication Bypass (CVE-2026-20079): cisco-sa-onprem-fmc-authbypass-5JPp45V2
• Cisco PSIRT — Secure FMC Static Credential (CVE-2026-20316): cisco-sa-fmc-static-cred-BET3Cjh
• CISA Known Exploited Vulnerabilities catalog / KEV JSON feed (CVE-2026-20079 added 2026-09-09, due 2026-09-12; CVE-2026-20316 added 2026-07-29, ransomware use Known)
• The Hacker News — “Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware” (2026-09-11)
• Help Net Security — “Cisco FMC bugs exploited by nation-state and ransomware actors” (2026-09-10)

Pack note: in-house SA-research publish pack (not native SearchAtlas Content Genius). Source mix: Cisco advisories + CISA KEV + Talos coverage via THN/HNS. Reddit JSON unavailable (typical 403); web/advisory sourcing used instead.