Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.
Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.
- CVE-2026-20079 is a critical unauthenticated authentication bypass enabling remote script execution and potential root access.
- CVE-2026-20316 allows sensitive data access via low-privilege accounts and can be chained for privilege escalation.
- Three clusters tracked: UAT-12197 web shells, UAT-11823 Cyclops Blink, and UAT-11988 Qilin ransomware operations.
- Qilin operators used impacket, Invoke-TheHash, and custom AV killers before encrypting selected endpoints.
- CISA KEV deadline of September 12, 2026 requires US federal agencies to patch CVE-2026-20079.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1572 Protocol TunnelingT1562.001 Impair Defenses: Disable or Modify ToolsT1486 Data Encrypted for Impact
- Vendors
- Cisco
- Organizations
- Cisco TalosCISA
- Countries
- Ukraine
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
From the original article
2 min read at securityaffairs.com
Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware. Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.