Cisco FMC CVE-2026-20079 exploited: auth bypass with CVSS 10.0

Cisco confirmed in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0) in Secure Firewall Management Center: an authentication bypass lets an unauthenticated remote attacker execute code as root. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2026, with a September 12 federal deadline; Talos attributes attacks to three clusters, including Qilin ransomware operators.

• CVE-2026-20079: CVSS 10.0 auth bypass exploited since September 2026
• Second flaw CVE-2026-20316 (CVSS 5.3) exposes sensitive data to low-privilege accounts
• Talos linked exploitation to three threat clusters, including Qilin operators
• CISA added the CVE to KEV on September 9 with a September 12 deadline