Exploitation of Cisco Secure FMC Vulnerabilities

Cisco Talos has identified active exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC): CVE-2026-20079 (authentication bypass, CVSS 10.0) and CVE-2026-20316 (static credentials). These vulnerabilities allow unauthenticated remote attackers to obtain root access or log in with low-privileged accounts to facilitate lateral movement and malware deployment.

Technical analysis reveals three distinct activity clusters. UAT-12197 uses JSP web shells for credential exfiltration; UAT-11823 (attributed to the Russian Sandworm APT) deploys the Cyclops Blink modular implant via malicious Makeself packages; and UAT-11988, a Qilin ransomware affiliate, leverages FMC tooling for extensive environment reconnaissance and domain-wide encryption.

These attacks target critical infrastructure management planes, posing a severe risk to network integrity. Affected organizations should immediately apply Cisco-issued hotfixes and monitor for unauthorized use of legitimate binaries like package_info.pl and OmniQuery.pl.