Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Summary: Cisco Talos is tracking active exploitation of two Secure Firewall Management Center flaws: CVE-2026-20079, an authentication bypass rated CVSS 10.0 that lets an unauthenticated remote attacker run scripts and gain root on the underlying OS, and CVE-2026-20316, a CVSS 5.3 flaw allowing login with a low-privileged account that can be chained with other FMC vulnerabilities to elevate privileges. Talos describes three post-compromise clusters - UAT-12197 (web shells, a JAR command executor, credential exfiltration), UAT-11823 (Netcat reverse shell, proxy tooling, and a Cyclops Blink variant previously attributed to Sandworm), and UAT-11988, assessed as a ransomware operator using static credentials and built-in FMC tooling before deploying Qilin ransomware.
Bottom line: A CVSS 10.0 authentication bypass on the appliance that manages your firewalls, exploited in the wild by actors whose tooling overlaps with Sandworm and Qilin affiliates, means the control plane guarding your network perimeter is itself the entry point - and hotfixes are available now, ahead of next week's hardening release.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20079 CVE-2026-20316
Related: Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data Cyber Risks ·
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware Cyber Risks ·
CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026