Column 1
Skip to content

Cisco FMC CVE-2026-20079: Apply the KEV Hotfix and Check Recovery

September 9, 2026

CVE-2026-20079 is an actively exploited Cisco Secure Firewall Management Center vulnerability. Cisco’s September 9 update confirms exploitation, and CISA added it to KEV that day. This is renewed patching urgency for a March 4 disclosure, not a newly discovered September 10 flaw.

The featured image is an illustration, not evidence from a customer system. Fix I.T. Phill has not assessed your appliance.

Check the correct product

The critical authentication bypass can give an unauthenticated remote attacker root access. It affects FMC regardless of configuration. Cisco’s SaaS SCC Firewall Management has already received the correction; Cisco says no customer action is required there. ASA, FTD and FDM are not affected by this advisory. Reduced internet exposure is not a patch.

Select Cisco’s branch-specific hotfix

The vendor’s current table maps FMC branches to these hotfix identifiers. Use the exact package and installation notes linked from the advisory; do not treat the identifiers as commands or interchangeable base releases.

  • 7.0: GB-7.0.9.1-3
  • 7.2: HL-7.2.11.1-4
  • 7.4: HG-7.4.7.1-3
  • 7.6: CY-7.6.5.1-2
  • 7.7: AM-7.7.12.1-2
  • 10.0: P-10.0.1.1-2

No workaround fixes the vulnerability. If compromise is suspected, contact Cisco TAC: the preventive hotfix may not resolve an existing compromise.

Plan the maintenance safely

  1. Record the FMC product, installed release and responsible administrator. Keep credentials and appliance identifiers out of public tickets.
  2. Confirm support entitlement, hardware compatibility and the installation prerequisites in the current vendor notes. Resolve an unlisted branch with support before choosing a package.
  3. Agree a maintenance window, an approved recovery plan and a way to maintain administrative access. Do not improvise changes to unrelated firewall policy while patching.
  4. Obtain the package from Cisco’s official download channel and verify it using the vendor’s provided integrity information.
  5. Complete the documented update process and retain a concise change record, including the package identity and completion time.

Verify service and recovery separately

After maintenance, confirm the reported software and hotfix state, management access, managed-device connectivity and expected policy-deployment health. Investigate unexpected failures before declaring the change complete. Review the vendor’s detection guidance through the official advisory and preserve relevant evidence privately if escalation is needed. A healthy login screen or a completed update does not establish that earlier activity was harmless.

Tell affected service owners what was updated, what was verified and what remains under investigation. Avoid claiming every Cisco product was vulnerable or that all customers were compromised.

Related guidance and sources

Our earlier FMC checklist covers a different CVE; it is not a substitute for this hotfix. Teams maintaining customer websites can use WordPress support to coordinate application checks around infrastructure maintenance.

This article is based on the Cisco advisory, version 2.5, the CNA record and CISA KEV, reviewed September 10, 2026 UTC. It is source validation, not an appliance assessment or laboratory claim.