Cisco Talos has revealed that critical vulnerabilities in the Secure Firewall Management Center (FMC) are being actively exploited by three distinct threat clusters, including Russian state-sponsored hackers and the Qilin ransomware group.

  • Two critical vulnerabilities (CVE-2026-20079 and CVE-2026-20316) in Cisco FMC were exploited.
  • Attackers include Russian state-sponsored group Sandworm and Qilin ransomware affiliates.
  • Exploits allowed for root-level script execution, credential theft, and deployment of Cyclops Blink malware.

In a startling revelation, Cisco Talos has confirmed that two recently patched vulnerabilities within the Secure Firewall Management Center (FMC) have become prime targets for sophisticated cyber adversaries. These flaws have been leveraged by three separate threat clusters to penetrate secure networks, steal sensitive data, and deploy destructive payloads.

The primary vulnerabilities at the center of this crisis are CVE-2026-20079, a maximum-severity authentication bypass flaw with a CVSS score of 10.0, and CVE-2026-20316, which involves static credentials for low-privileged accounts. While the latter has a lower CVSS score of 5.3, Cisco warns that it can be chained with other flaws to achieve full privilege escalation.

Read Also:OpenAI Models Breach Sandbox to Hack Hugging Face During Security Testing

The Three Threat Clusters

Talos has identified three distinct groups, tracked as UAT-11988, UAT-11823, and UAT-12197. The first, UAT-11988, is linked to the Qilin ransomware gang. These actors used static credentials to perform deep reconnaissance, stealing Active Directory and MySQL credentials before deploying Python SOCKS5 proxies to maintain persistence and eventually encrypting endpoints with ransomware.

The second cluster, UAT-11823, shows high-confidence overlaps with the Sandworm APT, a notorious Russian state-sponsored group linked to the GRU. This group utilized a malicious license.tmp file to establish a Netcat-based reverse shell, granting them root access. They subsequently deployed Cyclops Blink, a modular Linux malware used for network sniffing and persistent backdoors.

The third group, UAT-12197, focused on data exfiltration. By exploiting the authentication bypass flaw, they installed a JSP-based web shell and a malicious JAR file (cmd.jar) to query internal databases and siphon off user authentication data.

Why This Matters

BozokMedia analysis shows that the exploitation of management-plane devices like the FMC is particularly dangerous because these systems possess high-level visibility and control over the entire network infrastructure. When a firewall manager is compromised, the very tool meant to protect the perimeter becomes the gateway for the attacker.

The ability of state-sponsored actors to chain low-severity credential flaws with critical bypasses proves that 'low' risk ratings can be deceptive in a coordinated attack.

Cisco has released emergency hotfixes and is preparing a comprehensive hardening update. The company urges all FMC users to apply these patches immediately to prevent further intrusions.

Did You Know?: The Sandworm group is infamous for the NotPetya attack, one of the most destructive cyberattacks in history, which caused billions of dollars in global damages.

Vulnerability Comparison

CVE ID CVSS Score Primary Impact Severity
CVE-2026-20079 10.0 Authentication Bypass / Root Execution Critical
CVE-2026-20316 5.3 Static Credential Access High (when chained)

Frequently Asked Questions

Q1: What should I do if I use Cisco FMC?
Immediately install the hotfixes provided by Cisco and monitor your logs for the license.tmp indicator of compromise.

Q2: Which groups are responsible for these attacks?
The attacks are attributed to the Qilin ransomware gang and Russian state-sponsored actors (Sandworm APT).