60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
U.S. CISA adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware
State-sponsored and ransomware actors actively exploit critical Cisco FMC flaws CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 to gain root access and deploy ransomware.
Cisco Talos confirmed in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated authentication bypass enabling root command execution) and CVE-2026-20316 (CVSS 5.3, hard-coded static credentials) in Cisco Secure Firewall Management Center. Three activity clusters were identified: UAT-12197 dropping a JSP web shell and credential harvester; UAT-11823, assessed as Sandworm, deploying a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate chaining the flaws before deploying ransomware. CISA added both CVEs to the KEV catalog with a September 12 remediation deadline for federal agencies.
82
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.
Cisco Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that lets unauthenticated remote attackers execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3), which permits low-privileged logins and can be chained for privilege escalation. Talos identified three post-compromise clusters: UAT-12197 deploying JSP web shells and a JAR command executor for credential theft; UAT-11823, an APT overlapping with Sandworm, deploying a Netcat reverse shell and Cyclops Blink malware; and UAT-11988, assessed as a ransomware operator with TTPs consistent with Qilin affiliates. Hotfixes are available, with a comprehensive hardening release due the week of September 14, 2026.
90
60
60
60
60