Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple Cisco Secure Firewall devices across a network.
Two FMC vulnerabilities under active attack
“Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software,” the company’s researchers confirmed on Wednesday.
These are the above mentioned CVE-2026-20079 and CVE-2026-20316, which Cisco flagged as exploited in the wild in July 2026.
Both vulnerabilities are in FMC software’s web interface.
CVE-2026-20079 was discovered by Brandon Sakai of Cisco during internal security testing and fixed / disclosed in early March 2026.
This authentication bypass vulnerability is due to an improper system process that is created at boot time, and allows remote, unauthenticated attackers to execute scripts and commands that allow root access to the device by simply sending specially crafted HTTP requests to an unpatched device.
CVE-2026-20316 was reported by Jimi Sebree of Horizon3.ai and disclosed (with a fix made available) on July 29, when CISA also added it to its Known Exploited Vulnerabilities catalog.
Stemming from static (hard-coded) credentials for a low-privileged account, it allows unauthenticated, remote attackers to log in to an affected device/instance.
Three intrusion clusters, including Sandworm and Qilin activity
When, in July 2026, Cisco confirmed CVE-2026-20316 had been exploited by attackers, it added the same indicators of compromise to the security advisories for both CVE-2026-20316 and CVE-2026-20079, but did not say whether the latter was being leveraged in attacks.
The confirmation came yesterday, when the company’s threat intelligence analysts detailed three intrusion clusters leveraging one or both of these flaws.
The first instrusion cluster exploits CVE-2026-20079 and places a malicious web shell in the CSM Tomcat webroot directory, which is then used to place a malicious JAR file in the same directory. That file allows attackers to execute commands to obtain user authentication data and credentials.
The second intrusion, believed to be the work of Russian state-sponsored group Sandworm, starts with the attackers gaining access via one of the two vulnerabilities. Then they update the license.tmp file with a malicious copy, to establish a reverse shell to their command-and-control server. Finally, they harvest the configuration files of the managed Cisco firewalls, and install an implant that allows them to harvest credentials, execute commands and files, perform packet sniffing and network scanning, and more.
The third one, suspected to be the work of a Qilin ransomware operator, starts with the attackers logging in with the static credentials (CVE-2026-20316), then performing network and endpoint reconnaissance, stealing credentials, establishing additional access, deploying AV killers, and delivering the ransomware.
The analysts shared indicators of compromise related to these threat clusters.
“Due to Talos identifying in the wild abuse of these CVE’s, customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for CVE-2026-20079 and CVE-2026-20316,” they added.
“A comprehensive hardening release consisting of these hotfixes along with other internally discovered vulnerabilities will be released next week (Week of September 16th). Nonetheless, given the in the wild abuse we strongly recommend that customers apply the referenced hotfixes as soon as possible, pending the hardening release.”
An alternative temporary solution is to make the vulnerable FMC management interface inaccessible from the internet.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!