Cisco Talos says attackers are already inside the servers organizations use to manage their firewalls. In an advisory published on 9 September, it said it is tracking in the wild exploitation of two flaws in Cisco Secure Firewall Management Center (FMC), the console that pushes policy out to a whole fleet of Cisco firewalls. Three separate groups have used them.
The more serious flaw, CVE-2026-20079, scores 10.0 on the CVSS scale, the maximum. Talos describes it as an authentication bypass that lets an unauthenticated remote attacker run scripts on an unpatched FMC and take root on the underlying operating system. The second, CVE-2026-20316, scores 5.3 and lets an attacker sign in with a low privileged account. That is the flaw IntelFusions covered when CISA flagged the built-in password in July. On its own it sounds modest. It was enough.
Three intruders, one appliance
The first cluster, UAT-12197, exploited the critical bug, dropped a JSP web shell into the FMC's Tomcat directory, and used it to plant a small Java command runner named cmd[.]jar that queried the appliance's own database for user names and stored authentication data. A firewall manager holds credentials for everything it manages.
A Russian linked implant turns up again
The second cluster, UAT-11823, is the one that should worry defenders most. Talos attributes it with high confidence and says its tooling overlaps with Sandworm, the Russian military intelligence group behind years of destructive attacks on Ukraine. The operators rewrote a file called license.tmp so the appliance's own installer utility would execute it as root, opened a Netcat reverse shell, and harvested the configuration of every device the FMC managed. Then they pulled down a variant of Cyclops Blink, a modular Linux implant the United States and the United Kingdom previously attributed to Sandworm, which persists through startup scripts, hides its command lookups inside DNS over HTTPS, and handles credential theft, file transfer, command execution and packet sniffing.
Then the ransomware crew walked in
The third cluster, UAT-11988, is one Talos assesses with high confidence to be a ransomware operator. It signed in using the static credentials CVE-2026-20316 exposes, abused the same installer utility to run reconnaissance as root, and collected Active Directory and MySQL service account credentials plus a map of the domain controllers, ADFS, Exchange, file and database servers, staging it on the FMC and pulling it out over plain HTTP. It then stood up a SOCKS5 proxy and a reverse SSH tunnel forwarding LDAP, Kerberos, SMB and WinRM back to its own host, ran Impacket and custom antivirus killers, and deployed Qilin ransomware on selected endpoints.
CISA puts a federal deadline on it
CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog the same day, alongside a Fortinet heap overflow (CVE-2025-25249), a Chromium V8 out of bounds write (CVE-2026-87491) and a Citrix NetScaler authentication bypass (CVE-2026-19490) that IntelFusions covered when the emergency patch shipped in August. Binding Operational Directive 26-04 requires federal civilian agencies to prioritise catalog entries on exposed assets that hand an attacker total control.
Apply the hotfixes now, not next week
Cisco has already shipped hotfixes for both CVEs, and Talos is explicit that customers should apply them rather than wait for the broader hardening release planned for next week. Snort coverage is published for both flaws and for the malware. Anyone who finds evidence of access should treat every credential stored on the appliance as burned, because all three clusters went after them first. Talos lists the web shell as b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d, the Cyclops Blink implant as 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461, and command servers at 208[.]123[.]119[.]215, 89[.]34[.]96[.]56 and 91[.]214[.]78[.]118.
The lesson is not any single group. A state linked operation, a web shell crew and a ransomware affiliate all found the same appliance, and all understood that owning the thing which configures the firewalls beats getting past one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.