Cisco Talos reported exploitation of two Secure FMC vulnerabilities: CVE-2026-20079 (authentication bypass, CVSS 10.0) and CVE-2026-20316 (static credentials, CVSS 5.3). Three threat clusters (UAT-12197, UAT-11823, UAT-11988) used compromised FMC devices for reconnaissance, credential theft, and malware deployment. The Qilin ransomware group exploited CVE-2026-20316 to gather extensive network data and deploy ransomware. The Sandworm-linked cluster exploited both vulnerabilities to establish persistent backdoors using a malicious license.tmp file and deployed Cyclops Blink malware. Another cluster deployed a JSP web shell and malicious JAR to steal authentication data. Cisco has issued hotfixes and is releasing additional patches for comprehensive hardening.

Exploitation allows unauthenticated remote attackers to bypass authentication and execute commands as root on FMC devices, leading to full compromise. Attackers have used these vulnerabilities to deploy ransomware (Qilin), advanced persistent threat malware (Cyclops Blink), steal credentials, and maintain persistent access. The impact includes network reconnaissance, credential theft, lateral movement, and encryption of endpoint files. These attacks have been linked to both criminal ransomware groups and state-sponsored actors, increasing the risk to organizations using affected FMC versions.

Cisco has released hotfixes addressing both CVE-2026-20079 and CVE-2026-20316 and urges immediate installation of these patches. Additional comprehensive hardening patches are planned for release soon. Organizations should apply these official fixes promptly to prevent exploitation. No further mitigation recommendations are provided beyond applying Cisco's hotfixes and upcoming patches.