Know what changed.
Trace why it matters.

State-sponsored and financially motivated attackers are actively exploiting CVE-2026-20079, a critical authentication-bypass vulnerability in Cisco Secure Firewall Management Center (FMC). Cisco Talos is actively tracking exploitation of two vulnerabilities in Cisco Secure Firewall Management Center software: CVE-2026-20079 and CVE-2026-20316.

FMC is used to centrally manage multiple Cisco Secure Firewall devices across a network, so exploitation affects a management platform with centralized network-device administration.

Proofpoint researchers found four espionage groups using the same BlueMoon exploit chain against Chrome on Windows within days of one another. The campaign began with phishing emails; clicking a malicious link led to exploitation of two Chrome V8 vulnerabilities and then a Windows vulnerability that enabled escape from browser protections and higher privileges.

The article reports that publicly visible upstream fixes can give attackers clues before downstream updates reach users, enabling rapid development and adoption of weaponized exploit chains.

Check Point patched two critical vulnerabilities involving VPN-certificate handling in its firewall and management products. Check Point said both vulnerabilities could let an unauthenticated remote attacker execute code, but only under specific conditions that it did not describe.

The stated conditions limit what can be concluded about exploitability, but the reported unauthenticated remote-code-execution outcome makes the affected security boundary consequential.