Patch todayCisco Secure Firewall Management CenterFirewalls, VPNs & network gear

Ransomware groups are exploiting a perfect-10 Cisco firewall flaw

Who's affected: Organizations that manage Cisco firewalls with Secure Firewall Management Center (FMC), releases 7.0 through 10.0.
Under attack?: Yes. Cisco Talos tied attacks to three groups, including Qilin ransomware activity.
What to do: Upgrade to Cisco's fixed build for your release, and keep the management screen off the public internet.
Fixed in: See Cisco's advisory for your release
CISA deadline: Federal agencies must fix this by Sep 12, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-20079Severity score 10.0/10Chance of attack in 30 days: 88% (EPSS)Listed Sep 9, 2026Source: Resecurity ↗

Cisco scorecard: every exploited Cisco flaw →

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Cisco Secure Firewall Management Center

Hi [Client name],

Attackers are actively exploiting a security flaw in Cisco Secure Firewall Management Center.

Who's affected: Organizations that manage Cisco firewalls with Secure Firewall Management Center (FMC), releases 7.0 through 10.0.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Upgrade to Cisco's fixed build for your release, and keep the management screen off the public internet.

Fixed in: See Cisco's advisory for your release
Reference: CVE-2026-20079 – https://www.resecurity.com/en/blog/article/cisa-kev-alert-cisco-citrix-and-fortinet-vulnerabilities-under-active-exploitation

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

Ransomware groups are exploiting a perfect-10 Cisco firewall flaw

Also under attack in Firewalls, VPNs & network gear