Cisco Firewall Console Bug Is Under Attack By Three Crews

Yesterday evening this desk led with a Cisco firewall flaw already under attack. Tonight the update is not that it got patched. Cisco Talos confirmed three separate operators, some criminal, some state sponsored, are running CVE-2026-20079 against Secure Firewall Management Center right now, and FMC is not one box on the network. It is the console that pushes policy to every firewall it manages, so a bypass there does not compromise a device. It compromises the fleet.

Kai Tanner's desk has the telemetry. Cisco's advisory reads like routine disclosure with a patch attached. Talos is seeing three unrelated crews already inside before most customers finished the bulletin. Check Point patched two similarly rated VPN flaws the same week, unauthenticated paths into its own management products. Two vendors, the same pattern: the thing under attack is the control plane, not the traffic it was built to filter. For a Hong Kong or Singapore bank, that is not an abstraction, it is a scheduling problem. Tanner's filing is the one to read before the next change window, not after.

Elsewhere, Mei Chen's desk has a Taiwanese foreign minister touring Europe without a canceled meeting in sight. Vincent Lai has the Coast Guard outrunning the foreign ministry's messaging discipline near Scarborough Shoal. And Cheung Kwok-keung's dispatch on two MTR graffiti suspects arrested at the airport is the lightest thing in tonight's file, a break on a night the wire is otherwise Gulf oil and Senate hearings on AI extinction risk.

For any firm running this stack, the vulnerability that matters this quarter is not the one in the box facing the internet. It is the one in the console that manages the boxes, because that is where a single credential now buys an entire firewall estate instead of one appliance. Confirming FMC is patched and that its management interface is not reachable from outside the network takes an afternoon.

HKMA's TM-G-1 and MAS's technology risk guidelines both expect perimeter controls patched on a schedule. The BIS said this week that scheduled patching is too slow against AI-accelerated exploitation. Measured against either standard, an unpatched, internet-reachable FMC console is a finding, not a footnote, and the alternative to fixing it this week is explaining to a regulator why three different attackers found the console before the security team did.