Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Source Bleeping Computer
Mentioned vulnerabilities
Rated Critical by Threat Radar from the Bleeping Computer text
Data as of 10 Sep 2026, 15:48 UTC
What to do
AI-suggested
Cisco has released hotfixes addressing both CVE-2026-20079 and CVE-2026-20316 and urges immediate installation of these patches. Additional comprehensive hardening patches are planned for release soon. Organizations should apply these official fixes promptly to prevent exploitation. No further mitigation recommendations are provided beyond applying Cisco's hotfixes and upcoming patches.
Description
Two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC) have been exploited by multiple threat clusters linked to ransomware and state-sponsored attacks. CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0, allowing unauthenticated remote root access. CVE-2026-20316 involves static credentials for a low-privileged account and has a CVSS score of 5.3 but can be combined with other flaws for privilege escalation. Exploitation has led to deployment of web shells, credential theft, reverse shells, proxies, and malware including Qilin ransomware and Cyclops Blink backdoor. Cisco has released hotfixes for both vulnerabilities and plans further hardening patches. The attacks highlight significant post-compromise activity by ransomware affiliates and a Russian state-sponsored group known as Sandworm.