Cisco Secure FMC Flaw Lets Sandworm Skip the Login Screen

Cisco confirmed on September 10 that CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center, is being exploited in live attacks. No password, no login, no valid session required: send the right crafted HTTP request to a vulnerable FMC web interface and walk away with root.

Cisco's Talos threat intelligence team has already tied the flaw to three distinct attack clusters. One of them is linked to Sandworm, the Russian state-sponsored group best known for hitting power grids and shipping the VPNFilter botnet. That alone should move this from a patch-when-convenient item to a patch-today item for anyone running FMC.

RelatedCisco FMC Hardcoded Credentials Exploited: Patch Due Today

• CVE-2026-20079 scores a perfect 10.0 and lets an unauthenticated remote attacker execute commands as root on Cisco Secure FMC, the console that manages firewall policy across an entire fleet of devices.
• The root cause is a leftover boot-time session: a partial csm_processes entry created in the sfsnort.sessions database persists if no admin logs in after startup, and attackers can upgrade it into working root privileges.
• Talos has identified three separate clusters exploiting the bug: a web shell that drops malicious JAR files to harvest credentials, a Sandworm-linked group delivering Cyclops Blink malware, and financially motivated actors working the same flaw independently.
• This is Cisco's second Secure FMC vulnerability disclosed in six weeks. CVE-2026-20316, a hardcoded-credentials bug GenZTech covered on August 1, is a different and less severe issue than this unauthenticated root RCE.

What is CVE-2026-20079, exactly?

Secure Firewall Management Center is the console enterprises and government agencies use to push policy across every Cisco firewall they run. It is not a single box protecting one network segment, it is the control plane for dozens or hundreds of them at once. That is what makes CVE-2026-20079 dangerous beyond the usual CVSS-10 headline: an attacker who gets root on FMC does not just own one server, they own the ability to reconfigure everything FMC manages.

Cisco PSIRT says it became aware of active exploitation in August 2026, and the fix landed alongside public confirmation on September 10. The advisory, tracked as cisco-sa-onprem-fmc-authbypass-5JPp45V2, describes an authentication bypass that requires nothing from the attacker but network reachability to the FMC web interface. No stolen credentials, no phishing, no insider access.

How a leftover boot-time session becomes a way in

The technical root cause is almost mundane, which is part of why it is so effective. When an FMC system boots, a startup process creates a partial csm_processes session entry in the sfsnort.sessions database. Under normal operation, an administrator logs in shortly after, and that session gets superseded. But if nobody authenticates after boot, the partial session just sits there.

Attackers found they could reach that dangling session over the network, send specifically crafted HTTP requests to the FMC web interface, and coax the stale session into behaving like a legitimate, authenticated one. From there it is a short hop to command execution as root. There is no exploit-development mystery left here either: Cisco, Talos, and the outlets covering this have all described the mechanism in enough detail that defenders can watch for it, and attackers clearly already have.

Three clusters, one open door

Talos is tracking three separate groups actively using this bug, and they are not doing the same thing with it. The first drops a web shell that delivers malicious JAR files, used to harvest authentication data from whatever touches the compromised FMC afterward, a classic credential-theft play that sets up further lateral movement. The second is the one drawing the most attention: a cluster Talos links to Sandworm, deploying Cyclops Blink, a botnet malware family Sandworm has used before against network edge devices, notably WatchGuard firewalls during the VPNFilter successor campaign. The third bucket is broader and blunter, financially motivated actors running the same exploit opportunistically, alongside the state-sponsored activity rather than instead of it.

Why the Sandworm connection matters

Sandworm has a track record of treating network edge devices, firewalls, routers, VPN gateways, as long-term footholds rather than smash-and-grab targets. Cyclops Blink's earlier run against WatchGuard hardware was not a one-off; it was infrastructure Sandworm rebuilt and repositioned after VPNFilter got burned. Seeing the same malware family show up against Cisco Secure FMC, on a fresh unauthenticated root bug, reads less like a spray-and-pray campaign and more like deliberate pre-positioning on management infrastructure that happens to sit at the center of a lot of enterprise and government firewall estates.

RelatedSimpleHelp Auth-Bypass Flaw Threatens MSPs at CVSS 10

That does not mean every FMC operator is a Sandworm target specifically. It does mean the flaw is attractive enough, and the access valuable enough, that a patient state actor bothered to build a deployment chain for it rather than leaving it to opportunists.

Not the first Cisco FMC bug this year, but a different animal

GenZTech covered CVE-2026-20316 on August 1, a hardcoded-credentials flaw in Cisco Secure FMC that let attackers authenticate using a fixed, undocumented account baked into the software. That was bad. This is worse. CVE-2026-20316 required knowing or guessing a specific set of credentials; CVE-2026-20079 requires nothing at all beyond network access and a crafted request, and it hands over root rather than a limited account. Help Net Security's reporting groups both CVEs together because they hit the same product family within weeks of each other, but they are structurally different bugs with different severities, and treating them as interchangeable understates how much worse the new one is.

Who actually needs to patch right now

Anyone running Cisco Secure FMC on-premises and exposed to a network an attacker can reach, directly or through a chain of pivots, is in scope. That includes large enterprises with dedicated security operations teams, managed service providers running FMC on behalf of multiple clients, and government agencies that lean on Cisco's firewall line for perimeter defense. MSPs deserve a specific callout here: a single compromised FMC instance managing several downstream clients turns one exploited box into a multi-tenant incident.

What security teams should do today

Apply Cisco's fixed software per the advisory first; there is no workaround here that substitutes for patching. After that, check logs for signs the flaw was already used: unexpected sessions tied to csm_processes, unfamiliar JAR files on the FMC host, or web server logs showing the kind of crafted requests described in the advisory. Restrict management-interface exposure to trusted networks and jump hosts if it is not already locked down; an unauthenticated root bug on an internet-facing management console is close to the worst-case exposure scenario. Rotate credentials that touched the box during the exposure window, since one of the three active clusters is built specifically to harvest them.

Original analysis by GenZTech. Source: BleepingComputer