Cisco Firewalls Are Under Active Attack, and CISA Just Set a 48-Hour Clock

If you manage Cisco firewalls, stop what you are doing and check your patch level. Cisco Talos confirmed this week that two critical vulnerabilities in Secure Firewall Management Center (FMC) (the console used to centrally manage fleets of Cisco firewalls) are under active exploitation by both nation-state actors and ransomware crews. CISA has added the flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by September 12.

Related reading: Microsoft's October 2026 Patch Tuesday Sets a Record With 1,407 Fixes · CISA Gives Agencies Three Days to Patch Three Exploited Linux Kernel Flaws.

This is the nightmare combination: maximum severity, perimeter-facing management plane, and confirmed in-the-wild abuse by multiple threat clusters simultaneously.

The two flaws

Both bugs live in the FMC web interface:

• CVE-2026-20079 (CVSS 10.0), an authentication bypass caused by an improper system process created at boot time. A remote, unauthenticated attacker can execute scripts and commands to obtain root access simply by sending crafted HTTP requests. Discovered internally by Cisco's Brandon Sakai; fixed back in early March 2026.
• CVE-2026-20316, static, hard-coded credentials for a low-privileged account, reported by Horizon3.ai's Jimi Sebree and disclosed with a fix on July 29, when CISA first cataloged it. Unauthenticated remote login to affected devices.

The March patch for CVE-2026-20079 has therefore been available for six months. Attackers are now feasting on everyone who didn't apply it, a pattern so consistent it barely qualifies as news, except for who showed up to the feast.

Three intrusion clusters

Talos analysts detailed three distinct campaigns using one or both flaws:

1. Web-shell deployers. The first cluster exploits CVE-2026-20079 to drop a malicious web shell into the CSM Tomcat webroot, then plants a malicious JAR in the same directory to harvest user authentication data and credentials.
2. Sandworm. The Russian state-sponsored group gains access via either flaw, overwrites the license.tmp file with a malicious copy to establish a reverse shell to adversary infrastructure, harvests the configuration of every managed firewall, and installs an implant capable of credential theft, command execution, packet sniffing, and network scanning. Read that again: the attackers exfiltrate the configurations of the firewalls themselves, the network's own defensive blueprints.
3. Qilin ransomware. A suspected Qilin affiliate logs in with the static credentials (CVE-2026-20316), performs network and endpoint reconnaissance, steals credentials, establishes persistence, deploys AV killers, and delivers ransomware.

A very crowded week

The Cisco disclosure landed in the middle of arguably the roughest patch week of the year:

• CISA's September 10 KEV batch added the Cisco flaw alongside a Citrix NetScaler authentication bypass (CVE-2026-19490, CVSS 9.3, with 56 honeypot exploitation attempts since September 3) and a Fortinet FortiOS heap overflow (CVE-2025-25249), all with a September 12 federal deadline.
• Check Point disclosed two 9.8-rated VPN certificate flaws (CVE-2026-85102/85103) enabling unauthenticated remote code execution on Security Gateways, found internally with no observed exploitation yet.
• N-able issued an emergency hotfix for CVE-2026-86218, a pre-auth RCE in its N-central RMM platform popular with MSPs, reportedly already exploited in the wild.
• A researcher dubbed Nightmare Eclipse dropped "ShieldCrash," a Microsoft Defender privilege-escalation zero-day claimed to bypass Microsoft's September patches.

Edge and management devices remain the initial-access vector of choice, quarter after quarter.

What to do

Cisco says a comprehensive hardening release ships the week of September 16, but explicitly advises against waiting for it:

1. Apply the existing hotfixes for CVE-2026-20079 and CVE-2026-20316 NOW.
2. Hunt with Talos's published indicators of compromise (web shells in
   the CSM Tomcat webroot, rogue JARs, modified license.tmp).
3. Review managed-firewall configs for signs of exfiltration or tampering.
4. Rotate credentials that traversed the FMC — assume harvested until proven otherwise.
5. Take the September 16 hardening release as well when it lands.