Cisco is addressing CVE-2026-20079, a critical authentication bypass vulnerability in its Secure Firewall Management Center and Security Cloud Control. Initially patched in March, exploitation in the wild was confirmed in September, prompting CISA to add it to their Known Exploited Vulnerabilities catalog. This flaw, with a CVSS score of 10.0, allows unauthenticated attackers to execute root commands on the underlying operating system via crafted HTTP requests to the management interface, which is considered the primary access point. The vulnerability exists in a system process created at startup and is independent of device configuration. A companion flaw, CVE-2026-20316, involved hardcoded low-privilege credentials, which provided an initial foothold for attackers. Cisco Talos attributed observed activity to three distinct clusters with varying attack methods. One cluster planted web shells and command executors, another, linked to Sandworm, chained both vulnerabilities to deploy the Cyclops Blink malware, and a third acted like a ransomware affiliate. Defensive measures include treating the management plane as an internet-facing risk and rotating credentials for all registered devices. Hunting for specific artifacts left by attackers is recommended alongside patching. Fixing design flaws like hardcoded credentials is also crucial for preventing future compromises.