Vulnerability
CVE for a critical Cisco Secure Firewall Management Center flaw allowing unauthenticated attackers to run root commands; CVSS 10.0.
Cisco confirmed on September 9 that attackers are exploiting a CVSS 10.0 bypass in its Firewall Management Center to run code as root. CISA added it to its Known Exploited Vulnerabilities list the same day, with a three-day deadline for federal agencies.
Reality
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishersReality
CVE-2026-20079 hands unauthenticated attackers root on Secure Firewall Management Center. CISA wants federal boxes fixed by September 12. The hot fix closes the path but does not evict anyone who already walked it.
Perspective Coverage
6 publishersReality
Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.
Reality
Eclypsium tracked 158 infrastructure advisories between August 25 and September 17. The exploited maximum-severity flaws it highlights are authentication bypasses in Cisco's Firewall Management Center and Identity Services Engine.
Reality
Cisco Talos says three separate clusters, one sharing tooling with Sandworm, worked the same CVSS 10.0 bypass in Secure Firewall Management Center. The scope change in that vector reaches every firewall the console manages.
Reality
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
Cisco patched CVE-2026-20079 in March 2026 and confirmed in September that attackers had used it in August. Talos ties three clusters to the console, including one it links to Sandworm tooling and a Qilin affiliate.
Reality
Twelve of the 20 Identity Services Engine CVEs Cisco fixed on September 16 are critical and three were public before the patch, but all three need an administrator account, so the queue starts elsewhere.
Reality
An authentication bypass in Cisco's firewall management console was fixed in March 2026 and exploited in the wild by August. Cisco Talos attributes the activity to three separate clusters with three different objectives.
Reality
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality