Active Exploitation of Cisco Secure Firewall Management Center Flaws CVE-2026-20079 and CVE-2026-20316 by Sandworm-Linked APT and Qilin Ransomware Actors

Cisco confirmed active exploitation of CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center enabling root command execution via crafted HTTP requests, alongside CVE-2026-20316 (CVSS 5.3), a…

Cisco has confirmed in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0), a critical authentication bypass in Cisco Secure Firewall Management Center (FMC) that lets unauthenticated remote attackers execute scripts and commands as root via crafted HTTP requests to the web interface, and CVE-2026-20316 (CVSS 5.3), which stems from static hard-coded credentials enabling unauthenticated low-privileged logins and can be chained for privilege escalation. Cisco Talos identified three post-compromise clusters: UAT-12197, which deployed a home.jsp JSP web shell and a cmd.jar JAR command executor to query internal databases (via OmniQuery.pl) and steal credentials; UAT-11823, an APT overlapping with Russia's Sandworm (GBHackers reports high-confidence attribution to a Sandworm-linked group), which used a Netcat reverse shell, configuration-harvesting scripts, and a Cyclops Blink variant with DoH C2 and init.d persistence, delivered via a malicious license.tmp file; and UAT-11988, assessed as a Qilin ransomware affiliate, which abused the CVE-2026-20316 static credentials for reconnaissance and AD enumeration and used living-off-the-land FMC tooling, SOCKS5 proxies, reverse-SSH tunnels, impacket, Invoke-TheHash, and custom AV killers before deploying Qilin ransomware. Shared IOCs and a July 23, 2026 log entry suggest both flaws were used in the same attacks. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for federal civilian (FCEB) agencies; CVE-2026-20316 was added in late July 2026, making CVE-2026-20079 the third FMC vulnerability in KEV this year after CVE-2026-20316 and CVE-2026-20131. Cisco patched CVE-2026-20079 in early March 2026 and published IOCs in late July; it has released hotfixes and cloud fixes, warns there are no workarounds and that patching does not remediate already-compromised devices, and urges customers to patch immediately or take the FMC management interface offline. A comprehensive hardening release is expected the week of September 14, 2026 per Cisco Talos and GBHackers (Help Net Security reports the week of September 16). Because FMC centrally manages Cisco Secure Firewall deployments, enterprise exposure is likely.