Cisco FMC exploitation reportedly spans three attack clusters
SecurityUnverifiedUpdated:
Cisco Talos reports exploitation of two flaws in Cisco’s FMC firewall-management product by three tracked clusters. The reported activity includes ransomware deployment, credential theft, and persistent access.
Two flaws and three post-compromise clusters
Cisco Talos reports that attackers exploited CVE-2026-20079, a maximum-severity authentication-bypass flaw, and CVE-2026-20316, a static-credential flaw, on FMC devices. It tracks the activity as UAT-12197, UAT-11823, and UAT-11988. Talos says the Qilin-linked cluster deployed ransomware after accessing an FMC device, while the cluster with Sandworm tooling overlap deployed a Cyclops Blink variant.
In July, Cisco had disclosed active exploitation of CVE-2026-20316 but had not confirmed exploitation of the CVE-2026-20079 authentication-bypass flaw.
Cisco Talos now reports that three clusters exploited the two FMC flaws, including a cluster it attributes with high confidence to Qilin ransomware affiliates and another linked by tooling overlap to Sandworm.
The reported activity connects two recently patched FMC vulnerabilities to several distinct post-compromise paths rather than a single intrusion pattern. Cisco Talos also says one cluster used both flaws, clarifying the reported connection between the vulnerabilities.
Sources
- BleepingComputerCisco FMC flaws exploited by ransomware gang, state-sponsored hackersRead source →