CVE-2026-20079 actively exploited remains an urgent remediation and compromise-verification problem for Cisco Secure Firewall Management Center operators. Cisco’s September 16 advisory revision now recommends upgrading affected systems to published fixed software releases. The earlier branch-specific hot fixes are no longer the preferred end-state remediation path.
Operators should do two separate things: upgrade to the appropriate fixed release to prevent future exploitation, then determine whether the FMC may already have been compromised. Installing fixed software does not prove that an exposed device was clean before the upgrade.
What Cisco Secure FMC operators should do now
Confirm the installed Secure Firewall Management Center release before selecting an upgrade. Do not assume remediation for one release train applies to another.
Cisco now recommends the published hardening releases that include the CVE-2026-20079 fix. Use Cisco’s current advisory or Software Checker to validate the correct target for your deployment.
Because active exploitation is confirmed, upgrading should be followed by Cisco’s documented indicator-of-compromise check. Cisco instructs operators to search FMC logs for activity associated with /var/tmp/license.tmp.
If the documented indicator appears, or other evidence suggests the FMC was compromised, contact Cisco TAC for recovery guidance. A software upgrade prevents future exposure to the fixed vulnerability but does not remove evidence or effects of an earlier compromise.
Which FMC releases contain the fix for CVE-2026-20079?
Cisco’s September 16 advisory lists the following first fixed releases for Secure FMC and Secure FTD release trains:
| Release train | First fixed release |
|---|---|
| 7.0 and earlier | 7.0.10 |
| 7.2 | 7.2.12 |
| 7.4 | 7.4.8 |
| 7.6 | 7.6.6 |
| 7.7 | 7.7.13 |
| 10.0 | 10.0.2 |
| 10.1 | 10.1.0 |
Cisco says customers should upgrade to an appropriate fixed software release. The September hardening releases include the CVE-2026-20079 fix as well as fixes for additional internally discovered Secure Firewall vulnerabilities.
What if you already installed the earlier CVE-2026-20079 hot fix?
Cisco previously supplied branch-specific hot fixes to prevent future exploitation of CVE-2026-20079. With the September hardening releases now available, Cisco recommends upgrading devices to the appropriate fixed software release. Customers who need information about the previously available hot fixes can contact Cisco TAC.
The security boundary remains important: whether a system is now fixed and whether it was compromised before remediation are different questions.
How to check for possible CVE-2026-20079 exploitation
Cisco’s advisory provides an FMC log check in expert mode using zgrep "package_info.*license" /var/log/messages*. Cisco says that if the resulting log message includes /var/tmp/license.tmp, the vulnerability may have been exploited on the device.
If exploitation is suspected, Cisco directs customers to contact TAC immediately for assistance with recovery options. Do not treat upgrading or an earlier hot fix as proof that existing compromise has been removed.
Why active exploitation changes the response
CVE-2026-20079 is rated CVSS 10.0. The vulnerability can allow an unauthenticated remote attacker to bypass authentication and execute script files to obtain root access on an affected Secure FMC system. Cisco says there are no workarounds that address the vulnerability.
Cisco Talos has described intrusion activity involving theft of sensitive configuration or credential material, deployment of web shells and tunnelling mechanisms, and other malware or persistence activity. A compromised firewall-management platform can therefore expose information useful for accessing or understanding a wider enterprise network.
Public evidence does not establish that every exploitation case followed the same intrusion chain, that every vulnerable FMC was compromised, or that every affected organization experienced lateral movement.
What remains unknown
Cisco and Talos have not publicly established a complete victim count, full geographic distribution or comprehensive exploitation timeline. Those uncertainties do not change the immediate operator task: identify the installed FMC release, upgrade to Cisco’s current fixed software, check for possible prior exploitation and escalate suspected compromise.
What operators should monitor next
Recheck Cisco’s advisory if the affected-release table changes, Cisco publishes additional indicators of compromise, recovery guidance changes or new exploitation details materially alter incident-response requirements.
Verification note: ThePulseSignal reviewed Cisco’s current CVE-2026-20079 security advisory, the September Secure Firewall hardening release and Cisco Talos exploitation findings. Cisco’s current guidance recommends upgrading to fixed software while preserving the separate requirement to investigate possible prior compromise.