Cisco warns of max severity Secure FMC flaws giving root access

Cisco released security updates addressing two maximum-severity, remotely exploitable vulnerabilities in Secure Firewall Management Center (FMC): an authentication bypass (CVE-2026-20079) that can yield root access and a remote code execution (CVE-2026-20131) that allows execution of arbitrary Java code as root; Cisco reports no evidence of active exploitation or public PoCs and also patched numerous other issues across its firewall and security products.