Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.
Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.
- Three clusters tracked as UAT-12197, UAT-11823, and UAT-11988 exploited Cisco FMC flaws
- CVE-2026-20079 is a CVSS 10.0 unauthenticated bypass allowing root-level script execution
- Qilin affiliates staged reconnaissance data and deployed ransomware after FMC compromise
- Sandworm-linked UAT-11823 deployed Cyclops Blink backdoor via malicious license.tmp file
- Cisco released hotfixes and urges customers to patch immediately
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1505.003 Web ShellT1486 Data Encrypted for ImpactT1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- Vendors
- Cisco
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
From the original article
4 min read at bleepingcomputer.com
Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.