GoKawiilCisco Talos: Ransomware and state hackers exploit FMC firewall flaws
Cisco Talos reported that three distinct threat groups—including Qilin ransomware affiliates and state-sponsored actors—have been exploiting two vulnerabilities in Cisco Secure Firewall Management Center. The flaws, a maximum-severity authentication bypass (CVE-2026-20079) and a static credential issue (CVE-2026-20316), let attackers gain root access, deploy web shells, steal credentials, and in some cases install Qilin ransomware or Cyclops Blink malware. Cisco has issued hot fixes and urges immediate patching, with broader hardening updates planned next week.
GoKawiil's interpretation of the reporting above, not reported fact.
Firewall management platforms sit at the core of enterprise network defenses, so their compromise gives attackers a powerful foothold to move laterally and disable security controls. The fact that both criminal ransomware crews and state-linked hackers independently weaponized the same bugs shows how quickly disclosed vulnerabilities become shared attack infrastructure, raising urgency for organizations to patch before wider exploitation spreads.
- Two Cisco FMC vulnerabilities, one rated maximum severity (CVSS 10.0), are being actively exploited in the wild.
- Three separate threat clusters, including Qilin ransomware affiliates, used the flaws for credential theft, web shells, and ransomware deployment.
- Cisco has released hot fixes and recommends immediate patching ahead of a more comprehensive update next week.
Yubico YubiKey 5 NFC Security Key — When attackers get in through authentication bypasses and static credentials, hardware-backed logins are the kind of defense that doesn't hand over a password. The YubiKey 5 NFC plugs into USB-A or taps an NFC phone to add phishing-resistant two-factor authentication across admin accounts, VPNs, and password managers. It's a pocket-sized upgrade for anyone who just read about credential theft and wants fewer reusable secrets floating around.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.