Cisco reveals 2 max-severity defects in firewall management software

**Executive summary:** Cisco disclosed two critical vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079 and CVE-2026-20131) that allow unauthenticated attackers to bypass authentication and execute arbitrary code — including elevation to root — via a boot-time process weakness and a Java deserialization flaw; Cisco released patches and reported no known exploitation but advised immediate upgrades as there are no workarounds.