Nation-State and Ransomware Actors Exploit Critical Cisco FMC Vulnerabilities
Two critical vulnerabilities in Cisco Secure Firewall Management Center (FMC) software are being actively exploited by nation-state actors, including Sandworm, and ransomware groups like Qilin.
Nation-state and financially-motivated attackers are actively exploiting two critical vulnerabilities in Cisco Secure Firewall Management Center (FMC) software, a central management platform for Cisco Secure Firewall devices. The vulnerabilities, CVE-2026-20079 and CVE-2026-20316, reside within the FMC's web interface and allow for remote, unauthenticated access.
CVE-2026-20079, an authentication bypass flaw discovered internally by Cisco, permits attackers to execute arbitrary scripts and commands with root privileges by sending specially crafted HTTP requests. This vulnerability was fixed and disclosed in early March 2026. The second vulnerability, CVE-2026-20316, reported by Horizon3.ai, stems from hard-coded credentials for a low-privileged account, enabling unauthenticated remote login. This flaw was disclosed with a fix on July 29, 2026, and subsequently added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Cisco Talos confirmed that these flaws are not just theoretical but are being actively abused in the wild. The company detailed three distinct intrusion clusters leveraging one or both vulnerabilities. The first cluster involves deploying a malicious web shell to gain command execution and steal credentials. The second, attributed to the Russian state-sponsored group Sandworm, focuses on establishing a reverse shell, harvesting firewall configurations, and deploying implants for further network compromise.
The third intrusion cluster is suspected to be the work of the Qilin ransomware gang. These attackers utilize the static credentials vulnerability (CVE-2026-20316) to gain initial access, followed by reconnaissance, credential theft, and the deployment of ransomware. This specific campaign highlights the direct link between the exploitation of these Cisco FMC flaws and active ransomware operations.
Cisco has released hotfixes for both CVE-2026-20079 and CVE-2026-20316, urging customers to apply them immediately. A more comprehensive hardening release incorporating these fixes and addressing other internally discovered vulnerabilities is scheduled for release in the week of September 16th. In the interim, organizations are advised to restrict internet access to the vulnerable FMC management interface as a temporary mitigation measure.
The active exploitation of these critical vulnerabilities underscores the persistent threat landscape targeting network infrastructure. The involvement of sophisticated actors like Sandworm and financially-motivated groups like Qilin demonstrates the high value placed on compromising network management systems for broad access and data exfiltration. The rapid weaponization of these flaws, as indicated by their inclusion in CISA's KEV catalog, necessitates swift patching and robust security practices.
This incident serves as a stark reminder for organizations to maintain vigilance over their network security devices and to prioritize timely patching of critical vulnerabilities. The interconnected nature of modern networks means that a compromise in a central management system like Cisco FMC can have cascading effects across an entire enterprise, making such vulnerabilities prime targets for advanced persistent threats and ransomware operations.
The new article provides further technical detail on the exploitation of CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC) software. It outlines three distinct threat actor clusters observed post-compromise: an unattributed actor deploying a web shell and credential harvesting tools, a Sandworm-linked group using the flaws to deploy Cyclops Blink malware, and a Qilin ransomware affiliate leveraging the vulnerabilities for network lateral movement and payload delivery. Additionally, the article details specific Indicators of Compromise (IOCs) for each cluster.
The new article provides further detail on the exploitation of Cisco's Secure Firewall Management Center vulnerabilities, specifically naming CVE-2026-20079 (authentication bypass) and CVE-2026-20316 (hard-coded password). It elaborates on the three distinct intrusion clusters observed by Cisco Talos, detailing the specific malware and techniques used by each, including the deployment of web shells, the Cyclops Blink malware linked to Sandworm, and the preliminary steps taken by Qilin ransomware operators before encryption.
This new report details an upgraded version of the Cyclops Blink botnet malware, now deployed by the likely Russian Sandworm threat group. The campaign leverages chained Cisco vulnerabilities, specifically CVE-2026-20079 and CVE-2026-20316, to target Cisco's Firewall Management Center (FMC) technology. The updated malware features a 64-bit architecture, enhanced network scanning, and packet-capture capabilities, representing a significant evolution from its previous iterations that targeted WatchGuard and ASUS devices.