What happened?
Cisco is warning of actively exploited security vulnerabilities in key network security products: Secure Firewall Management Center (FMC) and Identity Services Engine (ISE). In total, five vulnerabilities reach the maximum CVSS score of 10 out of 10 – the highest possible severity rating. Affected are CVE-2026-20079 (FMC) as well as CVE-2026-20130, CVE-2026-20192, CVE-2026-76460, and CVE-2026-76423 (ISE). According to the vendor, attackers are already actively exploiting these vulnerabilities. Anyone who has not yet installed the patches should act immediately.
The Details
The FMC vulnerability CVE-2026-20079 has been known since March, yet it appears the available security patches have not been installed widely. Particularly critical: remote attackers do not need authentication. Sending a specially crafted HTTP request to a vulnerable device is enough to gain root privileges. With these privileges, attackers can subsequently alter security policies or disable security functions entirely – a nightmare scenario for any firewall infrastructure.
According to Cisco, the following FMC versions are protected against this vulnerability: 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, and 10.1.0.
In the Identity Services Engine, which is responsible for network access control, attackers can, among other things, bypass authentication or even execute malicious code. Support for ISE versions up to and including 3.0 has already ended – affected administrators must urgently upgrade to a still-supported version. The relevant patches are: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
In addition to the critical vulnerabilities, Cisco's security advisory section lists further issues, including hardening guidance for ISE and FMC as well as additional problems such as an sftunnel root code execution flaw, Java deserialization vulnerabilities, and command injection flaws in ISE.
Assessment
The fact that five vulnerabilities are rated with the highest possible CVSS score of 10 underscores the severity of these security flaws. FMC and ISE are central management components in enterprise networks – anyone who gains root access or bypasses authentication here could, in the worst case, undermine an entire network's security architecture. It is particularly alarming that the FMC vulnerability has been known since March, yet attackers are only now actively exploiting it. This reflects a recurring pattern in IT security: valuable time often passes between the release of a patch and its widespread installation – time that attackers deliberately exploit.
For operators of security infrastructure – from network firewalls to physical protection systems such as deposit safes or access control systems – the same principle applies: a protective measure is only as good as its current maintenance. An unpatched FMC is, figuratively speaking, comparable to an offertory box whose lock has been known to be tamperable for months but was never replaced.
Practical Tips
- Immediately check which FMC and ISE versions are in use within your infrastructure.
- Install the patches provided by Cisco without delay – especially for CVE-2026-20079, since this vulnerability has been known since March and is now being actively exploited.
- Migrate ISE installations up to version 3.0 to a supported version without exception, as support for these is no longer available.
- Review the complete list of patched vulnerabilities in the security section of the Cisco website, as additional patches beyond the critical ones may also be relevant.
- After patching, verify that security policies and functions remain unchanged and active, in case an attack may have already occurred.
Outlook
Since Cisco products like FMC and ISE serve as central security authorities in many enterprise networks, the active exploitation of these vulnerabilities is likely to draw further attention from both security researchers and attackers alike. Companies that fail to patch their systems promptly risk becoming targets of automated attack waves once exploit code becomes more widely available. These incidents once again underscore how crucial consistent patch management is for security-critical infrastructure – whether it concerns digital firewalls or physical protection mechanisms such as access control systems.
