Tuesday 15 September 2026
Evening EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Security

Cisco Firewall Management Center Flaws Used by Ransomware Gangs and State-Sponsored Hackers

Three separate threat clusters, including Sandworm-linked APT group, exploited maximum severity vulnerability CVE-2026-20079 and static credential bug CVE-2026-20316

edit
By LineZotpaper
Published
Read Time2 min
Cisco has confirmed that two recently patched vulnerabilities in its Secure Firewall Management Center have been actively exploited by three separate threat clusters, including ransomware affiliates and the Russian state-sponsored Sandworm group. The flaws — CVE-2026-20079, a maximum-severity authentication bypass bug, and CVE-2026-20316, a static credential vulnerability — allowed attackers to deploy web shells, steal credentials, and in some cases deliver Qilin ransomware and Cyclops Blink malware.

Cisco's Talos security division disclosed that three threat clusters — tracked as UAT-12197, UAT-11823, and UAT-11988 — have exploited the vulnerabilities to compromise devices and conduct follow-on attacks.

The most critical flaw, CVE-2026-20079, carries a perfect CVSS score of 10.0 and allows unauthenticated remote attackers to bypass authentication and execute scripts as root on vulnerable FMC devices. The second flaw, CVE-2026-20316, has a CVSS score of 5.3 but is rated as High severity by Cisco because it can be chained with other vulnerabilities to elevate privileges. It allows attackers to log in using static credentials for a low-privileged account.

Cisco has released hot fixes for both vulnerabilities and is urging customers to apply them immediately. A broader hardening update, including patches for additional vulnerabilities, is scheduled for next week.

The cluster tracked as UAT-11988 is attributed with high confidence to affiliates of the Qilin ransomware gang. The attackers initially gained access via the CVE-2026-20316 static credential flaw, then used legitimate FMC tools to survey the victim's network, collecting hostnames, IP addresses, directory listings, and credentials. They staged data in publicly accessible files on the compromised server and downloaded it via HTTP GET requests. They then deployed a Python SOCKS5 proxy and reverse SSH tunnel to maintain access, forwarded ports for multiple services, and used post-exploitation tools including Impacket and custom EDR killers before encrypting files with Qilin ransomware.

A second cluster, UAT-11823, is tracked with high confidence to an advanced persistent threat (APT) actor whose tooling overlaps with the Sandworm APT group, a Russian state-sponsored hacking unit linked to the GRU. In these intrusions, the attackers exploited either CVE-2026-20079 or the static credential flaw. They modified a license.tmp file to establish a Netcat-based reverse shell to their command-and-control infrastructure, executing the malicious file as root using Cisco's legitimate package_info tool.

§

Analysis

Why This Matters

  • The use of a perfect-severity authentication bypass in a widely deployed network security appliance demonstrates that even security infrastructure can become an attack vector.
  • Active exploitation by both ransomware gangs and nation-state actors raises the stakes for organizations that have not yet patched — delay could lead to data theft, ransomware deployment, or persistent backdoor access.
  • The Sandworm group's involvement signals a potential threat to critical infrastructure and government networks, given the group's history of destructive attacks.

Background

Cisco's Firewall Management Center is a central management platform used to configure and monitor Cisco firewalls. It is deployed by a wide range of organizations, including enterprises, government agencies, and service providers. The two vulnerabilities — CVE-2026-20079 and CVE-2026-20316 — were disclosed in late August 2026. Sandworm is a Russian GRU-linked APT group known for attacks such as the 2015 and 2016 Ukrainian power grid outages, the NotPetya wiper attack, and Olympic Destroyer. Qilin ransomware, first observed in 2023, operates as a ransomware-as-a-service operation and has targeted multiple sectors globally.

Key Perspectives

Cisco Customers: Organizations using affected FMC versions face immediate risk of compromise. The hot fixes should be applied urgently, and security teams should check for indicators of compromise outlined in the Talos report. Security Researchers: The report highlights the importance of multi-layered defense and treating management interfaces as high-value targets. The static credential issue (CVE-2026-20316) is a reminder that default credentials remain a persistent risk. Critics/Skeptics: While Cisco has patched the flaws, the time between disclosure and active exploitation was short. Some may question whether disclosure should have been accompanied by more proactive notifications or temporary mitigations for slower-to-patch organizations.

What to Watch

  • Whether additional threat actors begin exploiting the vulnerabilities now that details are public, especially given the high CVSS score of CVE-2026-20079.
  • The content of the broader hardening patch Cisco plans to release next week — it may close additional attack paths identified during the investigation.
  • Reports of any large-scale ransomware incidents linked to Qilin or other groups that follow similar exploitation patterns.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe