Cisco FMC Flaws Exploited by Three Threat Groups to Deploy Qilin Ransomware
Critical vulnerabilities allow attackers to bypass authentication and gain root access.
1Critical Cisco FMC Vulnerabilities Exploited
Three distinct threat groups are actively exploiting two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC). The primary flaw, CVE-2026-20079, allows unauthenticated attackers to bypass security controls remotely, execute scripts, and potentially gain root access. The secondary vulnerability, CVE-2026-20316, enables access to sensitive data through low-privilege accounts. Cisco has linked these attacks to both ransomware operations and state-sponsored activities, highlighting the severity of the threats.
2First Attack Cluster: Credential Theft
The first cluster, tracked as UAT-12197, exploits CVE-2026-20079 to deploy JSP-based web shells and a Java Archive (JAR) command executor. These tools are used to query internal databases and harvest user authentication data. The attackers place malicious web shells in the CSM Tomcat webroot directory, decoding Base64 parameters to load malicious classes in JAVA processes. This method allows extensive credential exfiltration, posing significant risks to affected organizations.
3Second Cluster: Advanced Persistent Threat
The second cluster, attributed to UAT-11823, overlaps with the Sandworm APT group. Attackers exploit CVE-2026-20079 or use static credentials to gain initial access. They then deploy Netcat reverse shells, harvest device configurations, and install the modular ELF malware 'Cyclops Blink' for persistent access. This malware enables DNS over HTTPS resolution and packet sniffing, providing long-term control over compromised systems.
4Third Cluster: Qilin Ransomware Deployment
The third cluster, UAT-11988, involves Qilin ransomware operators who use static credentials for initial access. They perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware. The attackers probe endpoints, use tools like impacket and Invoke-TheHash, and ultimately encrypt selected systems. This cluster demonstrates the ransomware's sophisticated attack chain.
5Cisco's Urgent Recommendations
Cisco strongly advises customers to apply released hotfixes immediately and update detection rules using provided Snort SIDs. The company is working on comprehensive security hardening updates. CISA has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch it by September 12, 2026. CVE-2026-20316 was added in late July, underscoring the urgency of mitigation.
6Impact on Organizations
The exploitation of these vulnerabilities poses severe risks, including unauthorized access, data exfiltration, and ransomware deployment. Organizations using Cisco FMC must prioritize patching to prevent breaches. The involvement of state-sponsored actors and ransomware groups amplifies the threat, requiring heightened vigilance and proactive security measures to safeguard critical infrastructure.
7Technical Details of Exploits
CVE-2026-20079 allows attackers to bypass authentication and execute arbitrary scripts, while CVE-2026-20316 provides access to sensitive data. Attackers chain these flaws with other FMC vulnerabilities to escalate privileges. The use of web shells, custom command executors, and modular malware highlights the attackers' sophistication. Detailed analysis by Cisco Talos reveals the tactics, techniques, and procedures (TTPs) employed by each cluster.
8Broader Implications for Cybersecurity
The exploitation of Cisco FMC flaws underscores the persistent threat posed by vulnerabilities in critical infrastructure. The combination of ransomware operations and state-sponsored activities highlights the dual-use nature of these exploits. Organizations must adopt a layered defense strategy, including timely patching, network segmentation, and continuous monitoring, to mitigate such advanced threats effectively.