Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.
The vulnerability has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices.
"In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," Cisco updated its CVE-2026-20079 advisory to say on Wednesday.
Cisco did not disclose when the attacks began, who was behind them, or what post-exploitation activity was observed.
Cisco first disclosed CVE-2026-20079 in March, when the company said it had no evidence that the vulnerability was being exploited in attacks.
