Cisco Discloses Active Exploitation of FMC Vulnerabilities
Cisco has confirmed that three distinct threat clusters — spanning ransomware crews and a state-sponsored group — are actively exploiting two recently patched vulnerabilities in Secure Firewall Management Center (FMC) to steal credentials, deploy backdoors, and detonate ransomware inside victim environments.
The Vulnerabilities
- CVE-2026-20079 (CVSS 10.0) — An authentication bypass in the FMC web interface that lets an unauthenticated remote attacker execute arbitrary scripts and obtain root-level access.
- CVE-2026-20316 (CVSS 5.3) — Allows unauthenticated login using low-privilege accounts to reach sensitive data, and can be chained with other flaws for privilege escalation.
Chained together, the two bugs give attackers a path from zero access to root control of an organization's firewall management plane — the single system that governs policy across an entire Cisco firewall fleet.
Three Threat Clusters, Three Different Goals
Cisco Talos tracked distinct post-exploitation behavior across the campaigns:
- UAT-12197 deployed JSP web shells and Java command executors to query internal databases and harvest user authentication data and credentials.
- UAT-11823, a state-sponsored cluster, exploited both CVEs to deliver reverse shells and configuration-harvesting scripts, and was linked to deployment of Cyclops Blink, malware previously attributed to the Russian Sandworm group.
- UAT-11988 ran a ransomware operation, using legitimate FMC tooling for reconnaissance and credential collection in a living-off-the-land approach before terminating security tools and deploying Qilin ransomware on selected endpoints.
Why Firewall Management Planes Are High-Value Targets
FMC doesn't just manage traffic — it holds the keys to an organization's entire firewall policy and, often, credentials that reach deep into internal networks. Compromising it in one move can hand attackers both a persistence foothold and a map of the internal network topology, explaining why three unrelated threat actors converged on the same exposure within weeks of disclosure.
Mitigation
- Apply Cisco's hotfixes for CVE-2026-20079 and CVE-2026-20316 immediately — Cisco has also scheduled a broader hardening release addressing additional internally discovered issues
- Restrict FMC web interface access to trusted management networks only; it should never be exposed to the internet
- Audit FMC accounts and logs for unauthorized web shells, unfamiliar scheduled tasks, or unexpected low-privilege account logins
- Hunt for Qilin ransomware indicators and Cyclops Blink artifacts if FMC was internet-reachable during the exposure window
- Federal agencies face a CISA KEV compliance deadline of September 12, 2026
Source: The Hacker News, Cisco Talos