🚨 CISCO FIREWALL VULNERABILITIES ACTIVELY EXPLOITED — ROOT ACCESS, CYCLOPS BLINK AND QILIN RANSOMWARE OBSERVED Cisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC). The most serious: CVE-2026-20079 CVSS: 10.0 — CRITICAL The vulnerability allows an unauthenticated remote attacker to bypass authentication and execute scripts and commands that can provide ROOT access to the underlying operating system. Cisco says the vulnerability is being actively exploited in the wild. A second vulnerability, CVE-2026-20316 (CVSS 5.3), exposes static credentials for a low-privileged account and has also been actively exploited. But the post-exploitation activity is where this becomes particularly interesting. Cisco Talos identified THREE distinct intrusion clusters. 🔴 Cluster #1 — UAT-12197 Attackers exploited CVE-2026-20079 and deployed: * Web shells * JAR-based command execution * Credential harvesting * Data exfiltration 🔴 Cluster #2 — UAT-11823 Attackers exploited the FMC vulnerabilities and ultimately deployed CYCLOPS BLINK. Observed capabilities included: * Reverse shells * Credential harvesting * Configuration theft * Network reconnaissance * Packet sniffing * File upload/download * Arbitrary command execution Cyclops Blink has previously been attributed to Russia's Sandworm APT by U.S. and UK authorities. Cisco says UAT-11823 overlaps in tooling with Sandworm, but does NOT directly attribute this cluster to Sandworm. 🔴 Cluster #3 — UAT-11988 / RANSOMWARE Cisco assesses with HIGH CONFIDENCE that this actor is a ransomware operator. After gaining access to FMC, the attacker: * Conducted extensive internal reconnaissance * Harvested Active Directory and MySQL credentials * Enumerated domain infrastructure * Established SOCKS5 and reverse-SSH tunnels * Used Impacket and Invoke-TheHash * Deployed custom AV killers * Identified endpoints for encryption The intrusion ultimately resulted in QILIN RANSOMWARE being deployed on selected endpoints. Talos says the actor's TTPs were consistent with Qilin ransomware affiliates. ⚠️ Analyst Note: Compromising security infrastructure creates a particularly dangerous situation. The device intended to protect and manage the network becomes the attacker's foothold: Internet-facing FMC → Root access → Credential harvesting → Internal reconnaissance → Network tunneling → Lateral movement → Ransomware deployment Cisco has released hotfixes and strongly recommends applying them immediately. There are NO workarounds for CVE-2026-20079. Organizations running Cisco Secure FMC should treat this as an active-compromise scenario, not simply a patch-management exercise. Patch immediately — and investigate whether exploitation occurred before remediation. Official Cisco Talos research: https://blog.talosintelligence.com/fmc-ongoing-exploitation/ Official Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2 #DDW #Cisco #Qilin #Ransomware #CyberSecurity
Post summary
The post reports that CVE‑2026‑20079 (and CVE‑2026‑20316) are being aggressively exploited in the wild with multiple intrusion clusters, and Cisco has released hotfixes but no workarounds.
