Cisco Exploited CVEs 2026: FMC CVSS 10 Auth Bypass, ISE, Secure Email, ASA/FTD VPN, SD-WAN

Published 2026-10-08 · Last updated 2026-10-08

What’s been exploited

Firewalls: FMC, ASA, FTD

• CVE-2026-20079 (CVSS 10): a system process created at boot in Secure Firewall Management Center lets an unauthenticated attacker send crafted HTTP requests, run scripts, and get root on the FMC, the box that pushes policy to every firewall you own.
• CVE-2026-20316: FMC shipped with static credentials for a low-privileged account. An unauthenticated attacker can log in with it and read sensitive data. CISA marks this one as used by ransomware groups.
• CVE-2026-20349 (8.6): a crafted HTTP request to the Remote Access SSL VPN service on ASA or FTD reloads the device: your firewall and VPN go down on demand.

Identity and email

• CVE-2026-76460 (CVSS 10): an API endpoint in Identity Services Engine (and ISE Passive Identity Connector) doesn’t enforce authentication, giving unauthenticated access around the management UI. ISE controls who gets on your network.
• CVE-2026-76461 (9.8): the email parser in AsyncOS for Secure Email Gateway can be fed SQL inside a crafted message, leading to arbitrary commands as root. The attacker only has to send an email to your domain.

SD-WAN and voice

• CVE-2026-76504 (9.8): URI-encoding trick bypasses an authentication rule in the Catalyst SD-WAN Manager (vManage) API, giving admin privileges without logging in.
• CVE-2026-20245 / CVE-2026-20262: authenticated SD-WAN bugs (root via crafted file, arbitrary file write), typically chained after the bypass.
• CVE-2026-20230: SSRF in Unified Communications Manager 14 and 15 lets an unauthenticated attacker write files on the server.

Am I affected?

Cisco lists affected releases per train in each advisory, and the lists are long. The reliable way to check is the Cisco Software Checker: enter your product and version and it tells you which advisories apply and the first fixed release.

# ASA
show version | include Version
# FTD (from the FTD CLI)
show version
# FMC / ISE: version is on the web UI's About page; ISE CLI: show version
# Secure Email Gateway: version (CLI) or System Administration > System Upgrade

How to patch

1. Upgrade each product to the first fixed release from the Software Checker (or the advisory’s “Fixed Software” table). Most of these have no workaround per Cisco.
2. Prioritise anything reachable from the internet: Secure Email Gateways (they receive internet mail by design), ASA/FTD with AnyConnect/Secure Client VPN, and any FMC, ISE or SD-WAN Manager UI not restricted to a management network.
3. For CVE-2026-20316, after upgrading, confirm no unexpected accounts can log in to FMC.

Hardening

• Management interfaces (FMC, ISE, SD-WAN Manager, UCM admin) belong on an isolated management network or behind a VPN, never on the internet.
• On ASA/FTD, restrict which sources can reach the VPN portal if your users come from known regions, and keep threat-detection for VPN services enabled.
• Forward device logs to a SIEM or syslog server off the box. On compromised appliances, local logs are the first thing attackers clean.

Sources

• Cisco advisories: FMC auth bypass, FMC static credential, ASA/FTD VPN DoS, ISE auth bypass, Secure Email SQLi, SD-WAN auth bypass, Unified CM SSRF
• CISA Known Exploited Vulnerabilities catalog

← Back to Knowledge Base