Actively Exploited Cisco FMC, ISE, and ASA/FTD Flaws Enable Full Device Compromise
Active Exploitation · 49 sources · Updated 1mo ago · First seen Sep 17, 2026
Cisco released emergency fixes for more than 20 vulnerabilities across Identity Services Engine (ISE/ISE-PIC), Secure Firewall Management Center (FMC), Nexus Dashboard, and Secure Firewall ASA/FTD. Five flaws carry a maximum CVSS 10.0 rating: FMC vulnerability CVE-2026-20079 allows unauthenticated remote attackers to send crafted HTTP requests and gain root privileges, while CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, and CVE-2026-76460 in ISE can permit authentication bypass, privileged administrative or system access, and in some cases code execution. A successful FMC compromise could allow attackers to modify firewall policies or disable security controls.
Cisco reports active exploitation of flaws in FMC and ISE, and CISA added the ISE privileged-API vulnerability CVE-2026-76460 to its Known Exploited Vulnerabilities catalog. Active exploitation has also been reported for ASA/FTD vulnerabilities CVE-2026-20329 and CVE-2026-20330. No workarounds are available; organizations should urgently upgrade to Cisco's fixed releases and restrict management interfaces to trusted networks while patching. ISE 3.0 and earlier are unsupported and must first be upgraded to a supported version before fixes can be applied.
