Two vulnerabilities in Cisco Secure Firewall Management Center (FMC), for which fixes are already available, have been exploited in in-the-wild attacks by at least three distinct clusters. Analysis by Cisco Talos links the observed activity both to extortion-motivated cybercrime and to operators tied to state-sponsored campaigns. In one case, access to the firewall management system culminated in the deployment of Qilin ransomware; in another, tools and operational methods overlapping with those attributed to Sandworm emerged.
The most significant factor is not just the technical severity of the flaws, but the role FMC can play in an organization's infrastructure. It is a platform that centralizes the management of firewalls and security policies: compromising it can provide intruders with an advantageous vantage point to observe the network, gather information on internal identities, and build access pathways to other systems. Cisco therefore urges customers to install the published hotfixes without delay.
The two vulnerabilities at the center of the attacks
The first flaw is CVE-2026-20079, rated with a CVSS score of 10 out of 10. It allows an unauthenticated, remote attacker to bypass authentication on a vulnerable FMC instance and execute scripts with root privileges. In practice, a defect of this nature can turn an exposed management interface into an entry point offering the highest level of control over the device.
The other vulnerability, CVE-2026-20316, involves static credentials associated with a limited-privilege account. Its CVSS score is 5.3, but Cisco considers it high severity because the value of initial access changes radically if an attacker manages to combine it with other flaws or privilege escalation techniques. Even a non-administrative account on an appliance situated at the core of perimeter security can be sufficient to launch reconnaissance, steal operational secrets, and prepare lateral movement.
The two CVEs therefore represent different paths toward the same goal: accessing the firewall environment's management plane. In the first case, access can be gained without credentials; in the second, a default or static low-privilege account is exploited. Evidence gathered by Talos shows that the attackers were able to use both scenarios as a staging ground for operations far broader than simply controlling the device.
From FMC access to encryption with Qilin
The cluster identified as UAT-11988 is attributed with high confidence by Talos to affiliates of Qilin, a ransomware family operating under an affiliate model: developers and affiliate operators collaborate in compromising victims and carrying out extortion. In this campaign, the attackers gained access to an FMC by exploiting static credentials tied to CVE-2026-20316.
Once inside, they did not move immediately against user computers. They first leveraged legitimate built-in tools in FMC to map out the victim's environment. Reconnaissance covered hostnames and IP addresses, directory listings, Active Directory service account data, MySQL credentials, domain account information, computer inventories, and mappings between machine names and internal device addresses.
According to Talos, the collected information was staged in publicly accessible files on the compromised FMC server and then retrieved via HTTP GET requests. This choice highlights a critical step in modern ransomware intrusions: before attempting encryption, operators invest time in understanding the network architecture and finding accounts or services that make propagation more reliable.
To maintain a bridgehead into internal systems, the group installed a Python SOCKS5 proxy and a reverse SSH tunnel. It also forwarded traffic to essential services in enterprise Windows environments, including LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM. These protocols, if reachable by an attacker, can facilitate authentication, remote administration, and lateral movement. Later in the compromise, Impacket, Invoke-TheHash, and custom tools to neutralize EDR solutions also surfaced. The final phase was the deployment of Qilin across endpoints, culminating in file encryption.
The campaign attributed to an APT actor
A second set of intrusions, tracked as UAT-11823, has been attributed by Cisco Talos with high confidence to an APT actor whose toolkit overlaps with Sandworm. The Sandworm group is widely linked to Russian military intelligence, the GRU, and is known for destructive operations against governments and critical infrastructure. Talos therefore does not limit the picture to a ransomware issue: the same weaknesses have also proven attractive to threat actors pursuing espionage or sabotage.
In this case, access to FMC devices was achieved by exploiting CVE-2026-20079 or the static credentials from CVE-2026-20316. Post-compromise activities included the deployment of Cyclops Blink, malware previously associated with operations linked to Sandworm. The presence of this tool in an FMC investigation must be viewed in the context of using the appliance as a control node: anyone with access can pursue persistence, harvest credentials, and establish communications infrastructure into the target network.
Talos identified a third cluster, UAT-12197, as part of the same analysis. The fact that the company distinguishes three activity groups suggests that the exposure was not leveraged under a single operational pattern. Ransomware and state-sponsored actors differ in their objectives, timing, and techniques, but can converge on the same devices when they offer visibility and control across complex enterprise networks.
Priorities for FMC administrators
Cisco has released hotfixes for both vulnerabilities and announced broader hardening measures, including patches for additional flaws, scheduled for the week following the advisory's publication. For organizations running Secure Firewall Management Center, updating should not be the only measure. Because signs of active exploitation already exist, it is advisable to treat this effort as a compromise assessment rather than routine, deferrable maintenance.
Investigations should focus primarily on anomalous FMC logins, unexpected script execution, and the presence of web shells or unexpected processes. Files made accessible via the web on the server, suspicious HTTP requests, reverse SSH tunnels, and unauthorized SOCKS5 proxies also warrant attention. On the internal network side, security teams can look for unusual forwarding or connections to the directory and remote administration services cited by Talos, as well as attempts to disable EDR tools.
Finally, it is important not to dismiss the low-privilege account involved in CVE-2026-20316 as a marginal risk. In the Qilin case, that very access enabled an attack chain that ultimately reached endpoints. The operational takeaway is that the separation between security appliances, the management plane, and the administrative network must be verified with the same rigor reserved for the most exposed servers: a system designed to defend the perimeter can, if not updated and monitored, become an intrusion accelerator.
