Cisco FMC CVE-2026-20079 Actively Exploited

Cisco confirmed active exploitation of CVE-2026-20079, a critical (CVSS 10.0) authentication-bypass in Secure FMC that can allow unauthenticated remote execution as root; attackers have been observed deploying web shells, credential theft tools, and a Cyclops Blink variant. Cisco and Talos report multiple intrusion clusters, CISA added the CVE to its KEV catalog with a remediation deadline, and Cisco published hot fixes, log-based detection indicators (including package_info.pl invoking /var/tmp/license.tmp) and Snort SIDs; organizations are advised to identify affected instances, apply hot fixes, preserve evidence, and investigate for compromise.