Cisco has confirmed active exploitation of a maximum-severity (CVSS 10/10) authentication bypass vulnerability affecting Secure Firewall Management Center (FMC) that allows unauthenticated remote attackers to execute scripts and commands with root privileges. The flaw, tracked as CVE-2026-20079, is caused by an improperly created system process at boot, and can be exploited through maliciously crafted HTTP requests to the device’s web interface. The vulnerability also affects Cisco Security Cloud Control Firewall Management, although Cisco has already patched its cloud-hosted service. While Cisco says its PSIRT became aware of exploitation in August, indicators of compromise published in July 2026 (including a July 23 log entry involving /var/tmp/license.tmp) suggest attacks may have begun earlier. Notably, the indicators and hot fixes overlap with CVE-2026-20316, a separately exploited static-credential vulnerability disclosed in July, suggesting the two (2) flaws may have been leveraged together in the same attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) Catalog, requiring all federal civilian agencies to remediate affected systems by no later than September 12, 2026. Cisco says no workarounds are available and urges customers to upgrade immediately. CTIX analysts stress that while applying fixes prevents future exploitation, it does not remediate systems that have already been compromised.