Affected Systems

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. All unpatched versions vulnerable. Cloud-hosted Security Cloud Control already patched by Cisco.

Exploitation Status

Active exploitation confirmed by Cisco PSIRT as of August 2026. Evidence suggests exploitation may have begun as early as July 23, 2026 based on IOC timestamps. Attackers identity and post-exploitation activity not disclosed. CISA added to KEV catalog.

Business Impact

CVSS 10.0 critical vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root via crafted HTTP requests to FMC web interface. No authentication required. Likely chained with CVE-2026-20316 (static credentials) in attacks. Installing patches prevents future exploitation but does NOT remediate already-compromised devices. Federal agencies under CISA order to patch by September 12, 2026.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately upgrade all Cisco Secure FMC installations to the latest patched software release per Cisco advisory (no workarounds available)
  • Search /var/log/messages on all FMC devices for '/var/tmp/license.tmp' and 'package_info.pl' activity to detect potential compromise
  • If IOC found (example: 'sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp'), contact Cisco TAC immediately for incident response support
  • Assume compromised devices require full rebuild or forensic analysis—patching alone does not remove attacker persistence
  • Review FMC access logs and managed firewall configurations for unauthorized changes or credential theft since July 2026