Cisco’s Secure Firewall Management Center has a second maximum-severity flaw under active exploitation this year, and this one comes with a root shell attached. CVE-2026-20079 scores a full CVSS 10.0, lets an unauthenticated remote attacker run commands as root on the FMC web interface, and — according to Cisco Talos — is already being used by at least three distinct threat clusters, including the Russian state-sponsored group Sandworm. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 12.

What happened

FMC is the centralized console that administrators use to manage fleets of Cisco Secure Firewall (formerly FTD) appliances — policy, IPS signatures, VPN configuration, and access control all flow through it. CVE-2026-20079 traces to an improperly handled system process at boot: the startup sequence creates a partial csm_processes session record in the sfsnort.sessions database. If no administrator logs in after a reboot, that orphaned session persists in a state that can be upgraded into working authentication, giving an attacker access to a broad set of CGI scripts on the web interface without ever presenting valid credentials.

An attacker only needs network reachability to the FMC web UI and the ability to send crafted HTTP requests. No credential theft, no social engineering, no prior foothold — a single request against a reachable, unpatched device is enough to reach root.

Technical details

  • CVE: CVE-2026-20079
  • CVSS: 10.0 (maximum severity)
  • Root cause: Improperly created boot-time system process leaves a partial, upgradeable authentication session in the FMC sessions database
  • Attack vector: Network, unauthenticated — crafted HTTP requests to the FMC web interface
  • Affected component: Cisco Secure Firewall Management Center web interface, versions 7.0 through 7.7 and 10.0 (see Cisco’s advisory for the exact build matrix)
  • Exploitation status: Confirmed active exploitation since August 2026; added to CISA KEV with a September 12 federal remediation deadline

Talos’s incident response findings describe the post-exploitation tooling in detail: attackers drop a JSP web shell into the CSM Tomcat webroot, which decodes a parameter and loads it as a Java class into the running Tomcat process. That web shell is then used to plant a second-stage JAR — observed as cmd.jar — that accepts arbitrary command-line input and executes it via /bin/sh -c, giving the actor a durable, low-noise command execution channel that survives independent of the original web shell.

Impact

Talos attributes exploitation of CVE-2026-20079 (often chained with the earlier hardcoded-credential flaw, CVE-2026-20316) to three separate activity clusters. One is tied to Sandworm, the Russian GRU-linked APT best known for Cyclops Blink and prior attacks on Ukrainian and Western critical infrastructure, which used the access to deploy Cyclops Blink on compromised devices. A second cluster is assessed with moderate confidence to be affiliated with Qilin ransomware, using the foothold for credential exfiltration and lateral movement ahead of encryption. A third, financially motivated cluster has deployed reverse shells and proxy tooling for general access brokering.

Because FMC sits at the center of an organization’s firewall estate, root on the management console means the attacker can rewrite policy, disable inspection, exfiltrate configuration and credentials, and pivot into every appliance the console manages — a single compromised FMC instance can translate into fleet-wide firewall compromise.

Mitigation

  • Patch immediately. Cisco has published fixed releases; there is no workaround. Hotfixes do not remediate devices already compromised — Cisco is explicit that a patched-but-previously-exploited device still needs to be treated as breached.
  • Assume compromise on any internet-reachable FMC instance that was running an affected version between the disclosure window and today. Hunt for JSP web shells in the CSM Tomcat webroot and for unexplained JAR files (cmd.jar or similarly named) alongside them.
  • Review authentication and session logs for csm_processes sessions established without a corresponding administrator login, particularly following a reboot.
  • Restrict management-plane exposure. FMC web interfaces should never be internet-facing; confirm access is limited to a trusted management network.
  • Federal agencies and KEV-bound organizations: today, September 12, is the remediation deadline — treat any unpatched instance as an active incident, not a backlog item.

Cisco’s advisory and the CISA KEV catalog entry carry the authoritative version matrix and hotfix links. Cisco Talos’s writeup has the fullest detail on the observed web shell and JAR tooling for defenders building detections.