Critical Cisco Firewall Manager Flaw Under Active Attack by State-Backed Hackers and Qilin Ransomware Affiliates
Critical Cisco Firewall Manager Flaw Under Active Attack by State-Backed Hackers and Qilin Ransomware Affiliates
Cisco Talos has disclosed that two vulnerabilities in Cisco Secure Firewall Management Center (FMC) are being actively exploited in the wild, with researchers linking the activity to at least three distinct threat clusters. The combination of a maximum-severity flaw and multiple overlapping intrusion campaigns makes this one of the more consequential enterprise security disclosures of the year.
Critical Cisco FMC Flaws Under Active Attack
According to Cisco Talos, one of the two vulnerabilities, tracked as CVE-2026-20079, is a critical authentication bypass carrying the maximum CVSS score of 10.0. The flaw allows an unauthenticated attacker to gain remote root access to affected FMC deployments. A second vulnerability, CVE-2026-20316, is rated lower in severity at CVSS 5.3 and involves hard-coded or low-privilege credentials that can permit unauthenticated login. This second flaw has been added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, a listing often used to underscore the urgency of remediation for federal agencies and enterprises alike.
Talos has observed attackers chaining the two vulnerabilities together, using the initial access gained through one flaw to escalate privileges and achieve broader control over compromised systems.
Three Threat Clusters, One Shared Foothold
Talos researchers say they have identified three separate intrusion clusters exploiting the same underlying flaws. The pattern reflects a recurring security concern: once a critical vulnerability becomes known, multiple unrelated actors often race to exploit it before organizations can patch.
One cluster's tooling reportedly overlaps with Cyclops Blink, malware previously associated with the Russian state-linked group known as Sandworm. Talos states this attribution with high confidence. A second cluster is assessed, also with high confidence according to Talos, to be operating on behalf of the Qilin ransomware group, using compromised FMC devices as an initial foothold for deeper network compromise. A third cluster remains unattributed, which researchers suggest illustrates how broadly the vulnerability is being targeted across different types of actors.
It is worth noting that while Talos frames these attributions with high confidence, secondary reporting on the incident has generally used more cautious language, describing the Sandworm and Qilin connections as "suspected" or "believed" rather than definitively confirmed. Readers evaluating the severity of this disclosure should weigh both the vendor's stated confidence levels and the more hedged framing found elsewhere.
Inside the Attack: Tools and Techniques
Once inside compromised environments, the attackers reportedly deployed web shells and JAR-based command execution tools to maintain access and issue commands remotely. Credential exfiltration tools were also used, according to Talos, to expand the attackers' reach into broader network infrastructure beyond the initial FMC compromise.
A particularly notable technique described in the disclosure involves living-off-the-land methods, in which attackers abused legitimate FMC administrative tooling, specifically a utility referred to as package_info.pl, rather than relying solely on custom malware. This approach can make malicious activity more difficult to distinguish from routine administrative operations, complicating detection and incident response efforts for defenders.
What Organizations Should Do Now
Cisco has released hotfixes addressing both CVE-2026-20079 and CVE-2026-20316. A more comprehensive hardening release is reportedly planned for the week of September 16, though the exact timeline may vary depending on further vendor updates.
Given the active exploitation already documented by Talos, along with CISA's decision to add one of the flaws to its Known Exploited Vulnerabilities catalog, security teams are strongly advised to apply the available hotfixes as soon as possible rather than waiting for the broader hardening update. Organizations running Cisco Secure Firewall Management Center should treat this as a high-priority patching action given the combination of critical severity and confirmed real-world exploitation.
Attribution Caveats and Context
A recurring theme in coverage of this incident is the gap between vendor-stated confidence and the more cautious language used elsewhere. Talos itself describes the Sandworm and Qilin connections as high-confidence assessments, but many secondary outlets have opted for hedged terms such as "suspected" or "believed" when characterizing the same activity. This distinction matters for organizations trying to gauge not just the technical severity of the flaws but also the certainty behind claims about who is behind the exploitation.
More broadly, some observers see this incident as reflective of a wider pattern in which state-sponsored espionage groups and financially motivated ransomware operators increasingly converge on the same critical vulnerabilities, sometimes within a similar timeframe. Whether that convergence reflects coordination, coincidence, or simply the shared incentive to exploit high-value flaws quickly remains an open question that will likely be shaped by further investigation and disclosure.