ADVISORY SUMMARY
Cisco updated its advisory for CVE-2026-20079 (CVSS 10.0) on July 29, 2026 — a critical authentication bypass in Cisco Secure FMC Software caused by an improper system process created at boot time. An unauthenticated remote attacker can bypass authentication and execute arbitrary executable scripts to obtain root access via crafted HTTP requests, without requiring any credentials or prior device access. Cisco published the same /var/tmp/license.tmp indicator of compromise as for the actively exploited CVE-2026-20316, strongly suggesting these two flaws are being chained in active attacks.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
Apply the same Cisco Secure FMC hot fixes released for CVE-2026-20316 (covering releases 7.0, 7.2, 7.4, 7.6, 7.7, 10.0). No workarounds fully address this vulnerability. Restrict internet-facing access to the FMC management interface. Treat any FMC device as potentially compromised and conduct full forensic triage.
DETECTION SIGNATURES
Same IoC as CVE-2026-20316: check for /var/tmp/license.tmp via cat /var/log/messages | grep license in expert mode. Look for the www web-service account invoking package_info.pl as root. Monitor for unauthenticated HTTP requests to the FMC management interface and unusual script execution events at boot.
INDICATORS OF COMPROMISE
REFERENCES
- → https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-authbypass-CSCwt95974
- → https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html
- → https://nvd.nist.gov/vuln/detail/CVE-2026-20079