INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Critical Cisco FMC Flaw Exploited in Ransomware Attacks

| 2026-09-11 10:14 CRITICAL HIGH
JSON
Executive Summary AI-generated
A critical Cisco FMC flaw has been exploited by three threat groups to steal credentials, gain root access and deploy ransomware. The attacks were linked to a recent CVE-2026-20079 vulnerability that allows unauthenticated attackers to remotely bypass security controls and run scripts potentially gaining root access. Additionally, two more vulnerabilities - CVE-2026-20316 - have also been exploited by the same threat groups to gain sensitive data through low-privilege accounts. The attacks were detected in a recent incident report from Cisco linked to ransomware operations including Qilin.
Technical Mitigations AI-generated
* Apply released hotfixes and update detection rules: Immediately apply the recently patched Cisco FMC flaws to prevent exploitation by threat clusters linked to ransomware and state-sponsored attacks. * Use secure authentication mechanisms: Implement strong authentication protocols, such as multi-factor authentication or token-based access control, to reduce the risk of unauthorized access. * Monitor network traffic for suspicious activity: Continuously monitor network traffic for signs of malicious activity, including unusual login attempts, data exfiltration, or command execution. * Implement a web application firewall (WAF): Configure a WAF to detect and block potential threats, such as SQL injection attacks or cross-site scripting (XSS) exploits. * Regularly update operating systems and software: Keep all operating systems, including Windows, Linux, and macOS, up-to-date with the latest security patches and updates to prevent exploitation of known vulnerabilities.
Technical Observables
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
QilinQilinCyclops BlinkCyclops Blink CVE-2026-20079CVE-2026-20079 CVE-2026-20316CVE-2026-20316
Target & Sectors
Global Scope
Incident Timeline
‎July 23, weeks
The Cisco FMC vulnerability CVE-2026-20079 was exploited by the Lazarus Group in July, weeks before Cisco publicly disclosed the issue.
vulnerability CVE-2026-20079
The example log entry is dated July 23, weeks before Cisco says PSIRT became aware of exploitation of CVE-2026-20079 in August.
‎July 23
Threat actors used a Cisco FMC vulnerability exploit to target the system on July 23.
vulnerability CVE-2026-20079
" Cisco's latest update now confirms that CVE-2026-20079 has been exploited, but does not clarify whether the July 23 activity included exploitation of both vulnerabilities.
‎July 29, 2026
Threat actors used Cisco's FMC software to exploit a vulnerability.
organisation Cisco Secure Firewall Management Center
Cisco did not answer the questions directly and instead shared the following statement: "On July 29, 2026, Cisco released software fixes to address vulnerabilities in Cisco Secure Firewall Management Center (FMC).
‎July 29
Threat actors used a Cisco FMC Secure FMC vulnerability exploited as CVE-2026-20316 to target the system on July 29.
vulnerability CVE-2026-20316
As BleepingComputer reported on July 29 , Cisco disclosed that CVE-2026-20316 was being actively exploited and warned that it could be chained with other FMC vulnerabilities to elevate privileges.
On July 29, Cisco disclosed another Secure FMC vulnerability , tracked as CVE-2026-20316, caused by static credentials for a low-privileged account.
general_metric 20316 CVE-2026
On July 29, Cisco disclosed another Secure FMC vulnerability , tracked as CVE-2026-20316, caused by static credentials for a low-privileged account.
organisation Secure FMC
On July 29, Cisco disclosed another Secure FMC vulnerability , tracked as CVE-2026-20316, caused by static credentials for a low-privileged account.
‎August 2026
The Cisco PSIRT advisory was updated by the company on Wednesday due to active exploitation of CVE-2026-20079.
vulnerability CVE-2026-20079
"In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," Cisco updated its CVE-2026-20079 advisory to say on Wednesday.
‎2026/09/09
Threat actors exploited CVE-2026-20079 in Cisco FMC systems to target Federal Civilian Executive Branch agencies.
vulnerability CVE-2026-20079
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
general_metric 20079 CVE-2026
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution KEV
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Known Exploited
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
tactic T1588.006 - Vulnerabilities
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Federal Civilian Executive Branch
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
‎September 11, 2026
Threat actors used a Cisco FMC vulnerability to exploit the flaw and deploy Qilin ransomware.
tactic Ransomware
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware Pierluigi Paganini September 11, 2026 Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.
malware Qilin
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware Pierluigi Paganini September 11, 2026 Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.
organisation Cisco FMC
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware Pierluigi Paganini September 11, 2026 Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.
‎2026/09/11
The threat actors exploited CVE-2026-20079 and CVE-2026-20316 vulnerabilities in Cisco FMC to deploy Qilin ransomware.
organisation Makeself
“After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:” The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.
organisation SSH
“After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:” The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.
The attackers then deployed a Python SOCKS5 proxy and reverse SSH tunnel to maintain access to internal systems and forwarded ports for LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM.
organisation AV
“After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:” The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.
organisation Invoke-TheHash
“The threat actor conducted extensive probing of endpoints in the victim’s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers — all followed by the deployment of the Qilin ransomware on selected endpoints.”
organisation FMC
According to a new Cisco Talos report, the three clusters used compromised FMC devices to deploy web shells, steal credentials, create reverse shells and proxies, and in some attacks, deploy Qilin ransomware and Cyclops Blink malware.
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks.
The second flaw can be chained with other FMC vulnerabilities to increase privileges.
organisation CVE-2026-20079
CVE-2026-20079 has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts as root on vulnerable FMC devices.
Cisco first disclosed CVE-2026-20079 in March , when the company said it had no evidence that the vulnerability was being exploited in attacks.
organisation CVSS
CVE-2026-20079 has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts as root on vulnerable FMC devices.
The vulnerability has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices.
organisation JSP
Third cluster steals credentials The third cluster, tracked as UAT-12197, exploited CVE-2026-20079 and deployed a JSP-based web shell into the Cisco Security Manager Tomcat webroot directory.
The first cluster deploys JSP-based web shells and custom command executors into Tomcat webroot directories to query internal databases and harvest user authentication data and credentials.
organisation UAT-12197
Third cluster steals credentials The third cluster, tracked as UAT-12197, exploited CVE-2026-20079 and deployed a JSP-based web shell into the Cisco Security Manager Tomcat webroot directory.
organisation BleepingComputer
BleepingComputer contacted Cisco at the time to ask whether the two vulnerabilities were connected, whether CVE-2026-20079 was also being exploited, and why the same indicator appeared in both advisories.
At the time, BleepingComputer contacted Cisco to ask whether the two vulnerabilities were connected, whether CVE-2026-20079 had also been exploited, and whether Cisco intentionally added the shared indicator to both advisories.
organisation Secure Firewall Management Center
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.
Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws.
organisation EDR
After reconnaissance, the threat actor used post-exploitation tools including Impacket, Invoke-TheHash, and custom EDR killers.
organisation SMB
The attackers then deployed a Python SOCKS5 proxy and reverse SSH tunnel to maintain access to internal systems and forwarded ports for LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM.
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
organisation NETBIOS
The attackers then deployed a Python SOCKS5 proxy and reverse SSH tunnel to maintain access to internal systems and forwarded ports for LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM.
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
organisation Cisco Secure Firewall Management Center
Talos identified three attack clusters targeting Cisco Secure Firewall Management Center (FMC).
organisation Sandworm
“The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:” The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “ Cyclops Blink ” for persistent access, DNS over HTTPS resolution, and packet sniffing.
UAT-11823 ultimately deployed a variant of Cyclops Blink on compromised devices, a modular Linux malware family previously attributed to the Russian Sandworm threat group .
organisation ELF
“The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:” The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “ Cyclops Blink ” for persistent access, DNS over HTTPS resolution, and packet sniffing.
organisation DNS
“The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:” The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “ Cyclops Blink ” for persistent access, DNS over HTTPS resolution, and packet sniffing.
organisation HTTPS
“The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:” The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “ Cyclops Blink ” for persistent access, DNS over HTTPS resolution, and packet sniffing.
infrastructure Linux
UAT-11823 ultimately deployed a variant of Cyclops Blink on compromised devices, a modular Linux malware family previously attributed to the Russian Sandworm threat group .
organisation APT
APT hackers deploy Cyclops Blink A second intrusion cluster, tracked as UAT-11823, was attributed by Talos with high confidence to an advanced persistent threat actor whose tooling overlaps with the Sandworm APT group.
organisation Sandworm APT
APT hackers deploy Cyclops Blink A second intrusion cluster, tracked as UAT-11823, was attributed by Talos with high confidence to an advanced persistent threat actor whose tooling overlaps with the Sandworm APT group.
data_breach 445 SMB
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
data_breach 135 NETBIOS
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
organisation Snort
Cisco strongly urges customers to immediately apply released hotfixes and update detection rules using the provided Snort SIDs while awaiting upcoming comprehensive security hardening updates.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Cisco FMC)
organisation JAR
The web shell was then used to install a malicious JAR file named cmd.jar , which allowed them to execute commands on the server.
organisation IP
The attackers collected hostnames, IP addresses, directory listings, Active Directory service account credentials, MySQL credentials, domain account information, computer lists, and hostname-to-IP address mappings for internal servers and infrastructure.
organisation Active Directory
The attackers collected hostnames, IP addresses, directory listings, Active Directory service account credentials, MySQL credentials, domain account information, computer lists, and hostname-to-IP address mappings for internal servers and infrastructure.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation Cisco Secure FMC
The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management.
organisation Cisco Security
The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management.
organisation Cisco
Cisco says it has already patched the cloud-hosted Security Cloud Control service.
organisation Security Cloud Control
Cisco says it has already patched the cloud-hosted Security Cloud Control service.
organisation Static Credential
Details are outlined in the security advisories (Static Credential vulnerability, Authentication Bypass vulnerability), and Cisco strongly recommends customers immediately apply the available fixes," a Cisco spokesperson told BleepingComputer.
organisation Authentication Bypass
Details are outlined in the security advisories (Static Credential vulnerability, Authentication Bypass vulnerability), and Cisco strongly recommends customers immediately apply the available fixes," a Cisco spokesperson told BleepingComputer.
organisation the Cisco Technical Assistance Center
"Customers needing support should contact the Cisco Technical Assistance Center (TAC).
organisation TAC
"Customers needing support should contact the Cisco Technical Assistance Center (TAC).
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
‎September 12, 2026
The Lazarus Group exploited a Cisco FMC vulnerability (CVE-2026-20079) to target the Federal Civilian Executive Branch.
vulnerability CVE-2026-20079
CISA added CVE-2026-20079 to its KEV catalog, requiring U.S. federal agencies to patch it by September 12, 2026.
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution KEV
CISA added CVE-2026-20079 to its KEV catalog, requiring U.S. federal agencies to patch it by September 12, 2026.
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
general_metric 20079 CVE-2026
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Known Exploited
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
tactic T1588.006 - Vulnerabilities
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Federal Civilian Executive Branch
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
‎2026/09/12
The Lazarus Group exploited CVE-2026-20079 in Cisco FMC systems to target the Federal Civilian Executive Branch.
vulnerability CVE-2026-20079
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
general_metric 20079 CVE-2026
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution KEV
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Known Exploited
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
tactic T1588.006 - Vulnerabilities
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
attribution Federal Civilian Executive Branch
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
Tactical Metrics
Metrics
data_breach
445
Smb
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
Metrics
data_breach
135
Netbios
The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report.
Metrics
infrastructure
‎Linux
Affected Product
UAT-11823 ultimately deployed a variant of Cyclops Blink on compromised devices, a modular Linux malware family previously attributed to the Russian Sandworm threat group .
Intelligence Sources
BleepingComputer 2026-09-09
BleepingComputer 2026-09-10
Security Affairs 2026-09-11