Search: “fmc”

6 stories in the last 30d

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 10:14 UTC · 5d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-203165· 2 reads

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation

Cisco warns CVE-2026-76461 (CVSS 9.8), an unauthenticated root RCE in Secure Email Gateway AsyncOS, is actively exploited in the wild.

Cisco confirmed that CVE-2026-76461, a CVSS 9.8 email-parsing flaw in Secure Email Gateway AsyncOS, is being exploited in the wild since September 2026, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted emails containing malicious SQL statements. All physical and virtual SEG configurations are affected; Secure Email and Web Manager and Secure Web Appliance are not. CISA added the flaw to the KEV catalog with a September 17 federal remediation deadline, and Cisco released IoCs while noting root access lets attackers remove them.

SecurityWeekupdated Sep 15, 20:46 UTC · 13h agofirst Sep 15, 05:18 UTC · 1d agoExploit / PoC in the wild 15 sources CVE-2026-76461 CVE-2025-20393 CVE-2026-20079+1 CVEs

Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.

Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.

BleepingComputerSep 15, 07:31 UTC · 1d agoExploit / PoC in the wildCVE-2026-76461 CVE-2026-76440 CVE-2026-76441+3 CVEs

PaperCut Flaws Exploited in AI-Powered Attacks

GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.

Two PaperCut NG/MF zero-days, CVE-2026-82078 and CVE-2026-81578, disclosed August 27 and patched August 28, enable unauthenticated authentication bypass and remote code execution. GreyNoise observed a Russian-speaking threat actor using AI to orchestrate attacks against 440 deployments in 48 countries, including 204 education-sector organizations, achieving domain admin at 12 victims. Attack paths included harvesting LSASS memory and registry secrets, mounted NoPac attacks, and adding accounts to Domain Admins, with AI automation shortening compromises to minutes or seconds.

SecurityWeekupdated Sep 11, 10:05 UTC · 5d agofirst Sep 11, 08:18 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-82078 CVE-2026-81578

Critical NetScaler Vulnerability Exploited in Attacks

CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.

CISA warned that threat actors are exploiting CVE-2026-19490, a critical-severity flaw (CVSS 9.3) affecting NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix patched the bug on August 19, and Rapid7 warned it is remotely exploitable without authentication. Sensor data from Previdian shows exploitation ongoing since at least September 3, one day after a public exploit appeared on GitHub, with matching requests observed from three IPs across three countries. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to patch under BOD 26-04.

SecurityWeekupdated Sep 10, 18:57 UTC · 5d agofirst Sep 10, 12:20 UTC · 5d agoExploit / PoC in the wild 5 sources CVE-2026-194902· 2 reads