This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco releases hotfixes for one actively exploited and one critical vulnerability

Cisco is urgently fixing 2 vulnerabilities in Secure Firewall Management Center (FMC) [1][2]. The specific impact on a given product version can be verified using the Cisco Software Checker tool [3]. Fixes for individual releases [1][2]: 7.0 - Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar 7.2 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar 7.4 - Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar 7.6 - Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar 7.7 - Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar 10.0 - Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

Cisco Secure FMC Software - authentication bypass, OS command execution, privilege escalation - (CVE-2026-20079)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute arbitrary scripts and commands by sending specially crafted HTTP requests, thereby gaining root access to the operating system of the affected device [1][4]. The published IoCs can be found at [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 4. 3. 2026.

Cisco Secure FMC Software - authentication bypass (CVE-2026-20316)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can log in via the web interface with the privileges of a specific user and gain access to sensitive information due to the existence of static credentials for a low-privileged account [2][5]. The vulnerability is already being actively exploited [6] and the published IoCs can be found at [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 29. 7. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 30. 7. 2026.

CESNET, z.s.p.o. Logo