InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
Threat actor
UAT-11823
- Mentions · 7d0
- Mentions · 30d0
- All mentions8
- First seenSep 9, 2026
- Last mentionedSep 23, 2026
Timeline
8 articles · newest firstAttackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.
90
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Three threat clusters including a Sandworm-linked group and Qilin ransomware operators exploit Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316.
84
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
87
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.
82
Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware
State-sponsored and ransomware actors actively exploit critical Cisco FMC flaws CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 to gain root access and deploy ransomware.
82
Organizations Warned of Cisco Secure FMC Exploitation
Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.
88
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.
90
Related CVEs
by mentions- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-2013143%10.0Unauthenticated Java Deserialization RCE in Cisco FMC and SCC
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
- Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding
Appears with
- Sandwormthreat actor · 8
- UAT-12197threat actor · 8
- UAT-11988threat actor · 8
- Ciscovendor · 7
- Cyclops Blinkmalware · 7
- Cisco Secure Firewall Management Centerproduct · 6
- Qilinthreat actor · 6
- Cisco Talosorganization · 6
- CISAorganization · 3
- Qilin ransomwaremalware · 3
- Cyclops Blinkproduct · 3
- Ciscoorganization · 2
- Secure Firewall Management Centerproduct · 2
- CISAvendor · 2
- Aristaorganization · 1
- Windowsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.