Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Three threat clusters including a Sandworm-linked group and Qilin ransomware operators exploit Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316.
Cisco Talos identified three clusters of post-compromise activity exploiting CVE-2026-20079 (CVSS 10.0, unauthenticated web-interface authentication bypass enabling root code execution) and CVE-2026-20316 (CVSS 5.3, low-privilege login exposing sensitive data) in Secure Firewall Management Center. UAT-12197 deployed JSP web shells and a JAR-based command executor to query internal databases for credentials; UAT-11823 used a Netcat reverse shell, configuration-harvesting scripts and a Cyclops Blink variant previously attributed to Russia's Sandworm; UAT-11988 used living-off-the-land FMC tooling for reconnaissance before deploying Qilin ransomware. CISA added CVE-2026-20079 to its KEV catalog, requiring FCEB agencies to patch by September 12, 2026; CVE-2026-20316 was added in late July 2026.
- CVE-2026-20079 (CVSS 10.0) allows unauthenticated web-interface auth bypass and root code execution.
- UAT-12197 dropped JSP web shells and a JAR executor to harvest credentials from internal databases.
- UAT-11823 deployed a Cyclops Blink variant previously attributed to Russian state group Sandworm.
- UAT-11988 used living-off-the-land FMC tooling for reconnaissance before Qilin ransomware deployment.
- CISA added CVE-2026-20079 to KEV with a September 12, 2026 deadline for FCEB agencies.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059.004 Unix ShellT1213 Data from Information RepositoriesT1486 Data Encrypted for Impact
- Tags
- ciscocve-2026-20079cve-2026-20316cyclops-blinkqilin-ransomwaresandwormsecure-firewall-management-centerwebshell
- Organizations
- CiscoCisco TalosCISA
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
From the original article
2 min read at thehackernews.com
Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10. 0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.