Vulnerabilities & Exploits
Cisco firewall update includes two exploited FMC access flaws NCSC-NL reports Cisco’s Secure Firewall hardening release covers eight vulnerability classes across ASA, Threat Defense and Management Center, while confirming active exploitation of two earlier FMC flaws. Four of the eight new CVEs have CVSS scores of 9.0 or higher; Cisco reports no known exploitation of the remaining flaws.
The two FMC flaws, CVE-2026-20079 and CVE-2026-20316 , respectively let an attacker bypass authentication through an alternate route or gain access with hard-coded credentials. Either can get past the login barrier to FMC’s management interface, which is used to administer firewalls.
For teams using FMC to manage firewall estates, the exposure reaches the control plane, not just the appliance running it. The advisory does not say what attackers did after gaining access, so installing the fix alone cannot establish whether management was abused beforehand.
1 source · 6h ago
CVEs in this update
10 CVEs
Across Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software.
5 critical · 4 high · 1 medium · 0 low
2 in CISA KEV · 1 with EPSS above 1%
1 with functional or packaged public exploit code
Highest severity: CVE-2026-20079 · 10.0 CRITICAL
Highest EPSS: CVE-2026-20079 · 88.5%
Timeline Oct 28 Reported by NCSC-NL Advisories Sep 12 CISA federal deadline for CVE-2026-20079 passedSep 9 CVE-2026-20079 added to CISA KEVAug 1 CISA federal deadline for CVE-2026-20316 passedJul 29 CVE-2026-20316 added to CISA KEVSources Oct 28 NCSC-NL Advisories
Kwetsbaarheden verholpen in Cisco Secure Firewall ASA, Threat Defense en Management Center
Cisco heeft kwetsbaarheden verholpen in Secure Firewall ASA, Threat Defense en Management Center softwareproducten.
original Vendor digest: Cisco
Part of the PlainSec briefing for 2026-10-28
Every edition of this story: Cisco firewall update includes two exploited FMC access flaws
More from today Vulnerabilities & Exploits
Cisco firewall update includes two exploited FMC access flaws NCSC-NL reports Cisco’s Secure Firewall hardening release covers eight vulnerability classes across ASA, Threat Defense and Management Center, while confirming active exploitation of two earlier FMC flaws. Four of the eight new CVEs have CVSS scores of 9.0 or higher; Cisco reports no known exploitation of the remaining flaws.
The two FMC flaws, CVE-2026-20079 and CVE-2026-20316 , respectively let an attacker bypass authentication through an alternate route or gain access with hard-coded credentials. Either can get past the login barrier to FMC’s management interface, which is used to administer firewalls.
For teams using FMC to manage firewall estates, the exposure reaches the control plane, not just the appliance running it. The advisory does not say what attackers did after gaining access, so installing the fix alone cannot establish whether management was abused beforehand.
1 source · 6h ago
CVEs in this update
10 CVEs
Across Cisco Secure Firewall Management Center (FMC), Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software.
5 critical · 4 high · 1 medium · 0 low
2 in CISA KEV · 1 with EPSS above 1%
1 with functional or packaged public exploit code
Highest severity: CVE-2026-20079 · 10.0 CRITICAL
Highest EPSS: CVE-2026-20079 · 88.5%
Timeline Oct 28 Reported by NCSC-NL Advisories Sep 12 CISA federal deadline for CVE-2026-20079 passedSep 9 CVE-2026-20079 added to CISA KEVAug 1 CISA federal deadline for CVE-2026-20316 passedJul 29 CVE-2026-20316 added to CISA KEVSources Oct 28 NCSC-NL Advisories
Kwetsbaarheden verholpen in Cisco Secure Firewall ASA, Threat Defense en Management Center
Cisco heeft kwetsbaarheden verholpen in Secure Firewall ASA, Threat Defense en Management Center softwareproducten.
original Vendor digest: Cisco
Part of the PlainSec briefing for 2026-10-28
Every edition of this story: Cisco firewall update includes two exploited FMC access flaws
More from today