Critical Vulnerability Exploited in Cisco FMC Allows Attackers to Gain Root Access

Cisco's Secure Firewall Management Center (FMC) has been found vulnerable to an authentication bypass exploit, allowing attackers to gain root access and execute malicious scripts. The vulnerability, identified as CVE-2026-20079, carries a CVSS score of 10.0 and affects versions 6.4.0.13 through 10.0.1.

Cisco Talos has reported that three threat actor clusters - Sandworm, Qilin, and a credential theft cluster - are actively exploiting this vulnerability. The attackers are deploying web shells and malicious JAR files to facilitate credential theft via OmniQuery.

The attack chain involves bypassing authentication, gaining root access, and deploying a JSP web shell into the CSM Tomcat webroot. The attacker then executes the cmd.jar file to run the command: /var/jre/bin/java -jar cmd.jar ‘/var/sf/bin/OmniQuery.pl -db mdb -e “SELECT name, auth_data FROM users;”‘.

The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of September 12, 2026. Cisco has updated its advisory on September 9 to reflect active exploitation.