Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware

Cisco Talos has confirmed active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software, the central console used by administrators to manage fleets of Cisco firewalls. The more severe flaw, tracked as CVE-2026-20079, carries a perfect CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass login controls entirely, stemming from an improper system process created when an FMC device boots up. State-sponsored hacking groups and a ransomware affiliate have leveraged the flaws to seize root access, plant malware, and stage attacks on enterprise networks. BleepingComputer reports that a ransomware gang and state-linked actors are among those exploiting the vulnerabilities. The disclosure marks one of the year's more serious enterprise security incidents given FMC's role as the management hub for Cisco firewall deployments. Cisco Talos confirmed the active exploitation, though the company has not yet released full remediation details in the available reporting.

Global Impact

Economic: Enterprises face urgent patching costs, potential ransomware payouts, and business interruption losses; Cisco may see reputational damage and increased scrutiny of its security development lifecycle. Technological: The incident underscores the systemic risk of centralized management consoles—compromise of one FMC can expose an entire firewall fleet, potentially accelerating adoption of zero-trust architectures and segmented management planes.