Affected Systems
Cisco Secure Firewall Management Center (FMC) - all versions vulnerable to CVE-2026-20079 (CVSS 10.0, authentication bypass) and CVE-2026-20316 (CVSS 5.3, static credentials). Widely deployed security appliance used for managing Cisco firewalls.
Exploitation Status
Active exploitation confirmed by Cisco Talos. Three distinct threat clusters observed: UAT-11988 (Qilin ransomware affiliates), UAT-11823 (APT group with Sandworm tooling overlap, Russian GRU-linked), and UAT-12197 (credential theft). Exploitation began at least by July 2026.
Business Impact
Attackers gain root-level access to FMC devices, enabling network reconnaissance, credential harvesting from Active Directory and databases, lateral movement via reverse shells and SOCKS5 proxies, and deployment of ransomware (Qilin) or persistent malware (Cyclops Blink). Compromised FMC provides visibility into entire firewall-managed network topology, making this a high-value target for both ransomware operators and state-sponsored espionage. Organizations using FMC for security management face complete network compromise risk.
Urgency
🔴 Immediate
Recommended Actions
- Apply Cisco hotfixes for CVE-2026-20079 and CVE-2026-20316 immediately on all FMC instances
- Hunt for indicator of compromise: malicious /var/tmp/license.tmp file and cmd.jar in Tomcat webroot directory
- Review FMC access logs for unauthorized authentication attempts, especially using low-privileged static credentials
- Audit network for unauthorized SOCKS5 proxies, reverse SSH tunnels, and outbound connections to unknown infrastructure from FMC devices
- Reset all credentials stored in or accessible from FMC, including Active Directory service accounts, MySQL credentials, and domain accounts
- Monitor for Cisco's comprehensive hardening release next week and deploy immediately upon availability