Table of Contents
Introduction
Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities.
The attacks leverage CVE-2026-20079 (CVSS score: 10.0), a critical authentication bypass vulnerability, and CVE-2026-20316 (CVSS score: 5.3), which allows low-privilege access to sensitive data.
Three distinct threat clusters — including state-sponsored actors and ransomware operations — are actively exploiting Cisco FMC vulnerabilities. Immediate patching is strongly advised.
The Two Cisco FMC Vulnerabilities
CVE-2026-20079 (CVSS 10.0) — Critical Authentication Bypass
- Authentication bypass in the web interface of FMC software
- Allows an unauthenticated, remote attacker to bypass authentication
- Can execute script files on an affected device
- Can obtain root access to the underlying operating system
- Maximum severity rating (10.0)
CVE-2026-20316 (CVSS 5.3) — Low-Privilege Access
- Allows an unauthenticated, remote attacker to log in using a low-privilege account
- Provides access to sensitive data within susceptible systems
- Can be paired with other Cisco Secure FMC vulnerabilities to elevate privileges
Both vulnerabilities have been patched by Cisco. Customers are strongly advised to apply hotfixes for affected software versions.
Three Threat Clusters Exploiting FMC
Cisco Talos identified three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors.
| Threat Cluster | Vulnerability Exploited | Activity |
|---|---|---|
| UAT-12197 | CVE-2026-20079 | Deployed JSP-based web shells and a Java Archive (JAR)-based command executor to query internal databases and obtain user authentication data and credentials |
| UAT-11823 | CVE-2026-20079 & CVE-2026-20316 | Delivered a Netcat-based reverse shell, two bash scripts to harvest managed-device configurations, and a variant of Cyclops Blink (attributed to Russian state-sponsored group Sandworm) |
| UAT-11988 | CVE-2026-20316 | Ransomware operation — used living-off-the-land (LotL) attacks for reconnaissance, dropped tunneling tools, collected credentials, built target lists, terminated security tools, and deployed Qilin ransomware |
The involvement of Cyclops Blink — a modular ELF implant attributed to Russian state-sponsored group Sandworm — highlights the severity of these attacks.
Qilin Ransomware Attack Chain
The ransomware operation (UAT-11988) used a sophisticated attack chain:
- Initial access — Exploited CVE-2026-20316
- Living-off-the-land (LotL) — Used legitimate built-in FMC tooling
- Reconnaissance — Conducted extensive reconnaissance of the victim's environment
- Tunneling tools — Dropped tunneling tools to maintain network access
- Credential collection — Gathered credentials from the environment
- Target list — Built a list of endpoints to encrypt
- Security tool termination — Terminated security tools on targeted systems
- Qilin ransomware deployment — Deployed Qilin ransomware on selected systems
Qilin is a ransomware-as-a-service (RaaS) operation that has been active since 2022. It has been used in attacks against healthcare, education, and government organizations.
CISA Adds to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2026-20079 — Added to KEV catalog; Federal Civilian Executive Branch (FCEB) agencies required to apply patches by September 12, 2026
- CVE-2026-20316 — Added to KEV catalog in late July 2026
Cisco intends to ship a comprehensive hardening release for various internally discovered vulnerabilities next week.
Customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for CVE-2026-20079 and CVE-2026-20316.
How to Protect Your Organization
Immediate actions for organizations using Cisco FMC:
1. Apply Cisco Hotfixes Immediately
- Apply hotfixes for CVE-2026-20079 and CVE-2026-20316
- Check Cisco's security advisories for affected versions
- Plan for the comprehensive hardening release next week
2. Check for Compromise
- Look for unauthorized JSP web shells
- Check for suspicious Java Archive (JAR) files
- Review bash scripts for managed-device configuration harvesting
- Look for Netcat-based reverse shells
- Check for Cyclops Blink variants
- Monitor for Qilin ransomware indicators
3. Implement Network Segmentation
- Segment FMC management interfaces from general network access
- Restrict access to management ports
- Use VPNs for remote management access
4. Harden FMC Security
- Use strong, unique passwords for all accounts
- Enable multi-factor authentication where possible
- Audit accounts and remove unnecessary privileges
- Monitor for suspicious activity
5. Backup Critical Data
- Maintain offline backups of critical configurations
- Test backups regularly to ensure they can be restored
- Isolate backups from the network to prevent ransomware encryption
Taking these steps immediately can significantly reduce your organization's risk from Cisco FMC exploitation and Qilin ransomware.
Final Thoughts
The exploitation of Cisco FMC vulnerabilities by three distinct threat clusters — including state-sponsored actors and ransomware operations — is a serious security concern for organizations using Cisco Secure Firewall Management Center.
Key takeaways:
- CVE-2026-20079 — Critical authentication bypass (CVSS 10.0)
- CVE-2026-20316 — Low-privilege access (CVSS 5.3)
- Three threat clusters — UAT-12197, UAT-11823, UAT-11988
- Qilin ransomware — Deployed by UAT-11988
- Cyclops Blink — Used by UAT-11823 (Sandworm)
- CISA KEV — Both vulnerabilities added to catalog
- Apply patches immediately — Cisco has released hotfixes
If your organization uses Cisco Secure Firewall Management Center and needs assistance with security assessments, incident response, or threat hunting, contact SystemLogicIT for expert guidance.