This vulnerability is undergoing active exploitation.
This vulnerability is because there is an improper system process created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.
Cisco released software updates that address this vulnerability, according to an advisory. There are no workarounds that address this vulnerability.
This vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control (SCC) Firewall Management, regardless of device configuration.
Cisco SCC Firewall Management is a SaaS-delivered offering and upgraded by Cisco as part of maintenance. The fix for this vulnerability deployed to Cisco SCC Firewall Management environments. No user action ends up required.
Check for Exploitation
To determine if this vulnerability suffered from exploitation, use the zgrep “package_info.*license” messages* CLI command in expert mode. If the log message in the output includes /var/tmp/license.tmp this vulnerability may have ended up exploited on the Cisco Secure FMC device.
If you suspect exploitation, immediately contact the Cisco Technical Assistance Center (TAC) for assistance with recovery options. The hot fix files listed are for preventing future exploitation only and may not address existing compromise. Follow all Cisco TAC guidance if indicators of compromise are present.
CVE-2026-20079 is the case number for the vulnerability, which has a CVSS base score of 10.
Cisco released the following hot fixes to address this vulnerability and to protect users from future exploitation of this vulnerability. Users can download the hot fixes from the Software Center.
Source: Cisco
To help users determine their exposure to vulnerabilities in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory.
In August, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco recommends customers upgrade to a fixed software release to remediate this vulnerability.
Click here for additional Cisco security updates.