Cisco FMC Vulnerabilities Exploited by Threat Actors for Root Access and Malware Deployment

Cisco has warned of critical vulnerabilities in its Secure Firewall Management Center (FMC) Software. Two separate flaws, CVE-2026-20079 and CVE-2026-20316, have been exploited by threat actors to gain root access and deploy malware.

The most severe issue, a CVSS score of 10.0, allows unauthenticated remote attackers to bypass authentication on unpatched Cisco Secure FMC instances and run scripts that grant root access to the underlying operating system.

Talos has identified three separate clusters of post-compromise activity involving state-linked and financially motivated attackers. One cluster exploited CVE-2026-20079 to deploy a JSP-based web shell, while another used the static credentials exposed through CVE-2026-20316 to replace the license.tmp file with a malicious Makeself package.