Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware
State-sponsored and ransomware actors actively exploit critical Cisco FMC flaws CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 to gain root access and deploy ransomware.
Cisco Talos confirmed in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated authentication bypass enabling root command execution) and CVE-2026-20316 (CVSS 5.3, hard-coded static credentials) in Cisco Secure Firewall Management Center. Three activity clusters were identified: UAT-12197 dropping a JSP web shell and credential harvester; UAT-11823, assessed as Sandworm, deploying a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate chaining the flaws before deploying ransomware. CISA added both CVEs to the KEV catalog with a September 12 remediation deadline for federal agencies.
- CVE-2026-20079 (CVSS 10.0) lets unauthenticated attackers hijack an unclaimed boot session and execute scripts as root.
- Sandworm-linked UAT-11823 chained both CVEs and deployed a Cyclops Blink variant with DoH C2 and credential harvesting.
- Qilin affiliate UAT-11988 abused static-credential flaw CVE-2026-20316, harvested AD credentials, and deployed ransomware.
- CISA added both flaws to KEV; agencies must patch by September 12; hotfixes are already available.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1505.003 Web ShellT1562.001 Impair Defenses: Disable or Modify ToolsT1486 Data Encrypted for Impact
- Malware
- Cyclops Blink
- Organizations
- Cisco TalosCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.218.165.253 | e 208.123.119[.]215 UAT-11823 Netcat-based reverse shell C2 104.218.165[.]253 UAT-11823 Attacker’s vulnerability scanner used to probe |
| ipv4 | 208.123.119.215 | se shell C2; also linked to Cyclops Blink C2 infrastructure 208.123.119[.]215 UAT-11823 Netcat-based reverse shell C2 104.218.165[.]253 |
| ipv4 | 43.204.2.142 | 742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware sample 43.204.2[.]142 UAT-11988 Attacker IP address used to conduct intrusions |
| ipv4 | 89.34.96.56 | d8cc7a1a8c8e UAT-12197 cmd.jar — JAR-based command executor 89.34.96[.]56 UAT-11823 Netcat-based reverse shell C2; also linked to C |
| ipv4 | 91.214.78.118 | er’s vulnerability scanner used to probe for CVE-2026-20079 91.214.78[.]118 UAT-11823 Netcat-based reverse shell C2 6f98add5d1a772919 |
| sha256 | 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 | 079 91.214.78[.]118 UAT-11823 Netcat-based reverse shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware sample 43.204.2[.]142 UAT-1 |
| sha256 | b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d | e for all three observed campaigns. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6d |
| sha256 | db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e | 54fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp — web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar — JAR-based command executor 89.34.96[.]5 |
From the original article
3 min read at cybersecuritynews.com
Cisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC) Software, with state-sponsored hacking groups and a ransomware affiliate leveraging the flaws to seize root access, plant malware, and stage attacks on enterprise networks. The disclosure marks one of the year’s more serious enterprise security incidents, given FMC’s role […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.