Cisco flags active attacks through critical FMC flaws

Cisco has warned that attackers are actively exploiting two vulnerabilities in its Secure Firewall Management Center software, with intrusions leading to root-level access, credential theft, reconnaissance and malware deployment on compromised systems.

Cisco Talos said on September 9 that it had identified three clusters of post-compromise activity involving CVE-2026-20079 and CVE-2026-20316. The first flaw, rated a maximum 10.0 on the CVSS scale, can let an unauthenticated remote attacker bypass authentication and execute scripts and commands as root. The second involves static credentials for a low-privileged account and carries a CVSS score of 5.3, though Cisco rates it High because it can be chained with other flaws to elevate privileges.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-20079 to its Known Exploited Vulnerabilities catalogue on September 9 after confirming evidence of exploitation. Federal civilian agencies were given a September 12 remediation deadline for affected exposed assets, while CISA urged other organisations to prioritise the flaw because successful exploitation can hand attackers total control of a device.

Talos attributed one activity cluster, tracked as UAT-12197, to exploitation of CVE-2026-20079. Attackers deployed web shells and a Java Archive-based command executor and stole credentials after gaining access, according to the Cisco threat intelligence team.

A second cluster, UAT-11823, used both vulnerabilities and installed a Netcat-based reverse shell and proxy tools. Talos said the intrusion ultimately delivered a variant of Cyclops Blink, a modular malware family previously attributed by US and UK authorities to the Russian state-linked Sandworm group.

The Cyclops Blink variant observed by Talos was capable of establishing persistence, resolving command-and-control addresses through DNS over HTTPS, uploading and downloading files, harvesting credentials, executing arbitrary commands, scanning networks and sniffing packets. The attackers also used scripts to collect configurations from managed devices and stage the data in archives for exfiltration.

Talos separately linked a third intrusion cluster, UAT-11988, with high confidence to a ransomware operator. The actor gained access using the static-credential weakness, then used legitimate FMC tools for reconnaissance, deployed tunnelling software, harvested credentials and assembled a list of endpoints for encryption or locking. Cisco said the subsequent behaviour was consistent with tactics used by Qilin ransomware affiliates.

The operator also staged a SOCKS proxy and reverse-SSH tunnel to maintain access to internal systems, forwarding services including LDAP, Kerberos, SMB and Windows Remote Management. Talos said the attackers probed endpoints with open-source tools, deployed software designed to disable antivirus defences and then installed Qilin ransomware on selected machines.

The ransomware-linked activity also exposed the strategic value of an FMC compromise. Talos found attempts to enumerate domains, extract Active Directory and database credentials, identify servers and map hostnames to internal addresses. Information was staged on the management appliance and exfiltrated through HTTP requests before encryption activity began.

Cisco had disclosed CVE-2026-20079 in March and issued fixes, while CVE-2026-20316 was published on July 29 after the company’s product security team became aware of active exploitation during July. Neither flaw has a workaround, making software updates or vendor hotfixes the primary remediation.

The company said CVE-2026-20079 stems from an improper system process created during boot. Crafted HTTP requests can exploit the condition and permit execution of scripts and commands with root privileges. CVE-2026-20316 results from static credentials associated with a low-privileged account, allowing remote unauthenticated access to sensitive information and creating a path for privilege escalation when combined with other weaknesses.

Cisco has released hotfixes for affected FMC branches and urged customers to apply them immediately. It also advised organisations that suspect compromise to contact its Technical Assistance Center because preventive hotfixes may not remove an attacker who already has access.

Administrators can check for possible exploitation of CVE-2026-20316 through log entries identified in Cisco’s advisory, including activity involving a temporary licence file. Cisco cautioned that management interfaces exposed directly to the public internet present a larger attack surface, while systems without public access face reduced exposure.