Attackers didn't break through the firewall. They logged into the console that manages it.
CVE-2026-20079 — CVSS 10.0 — authentication bypass to root on Cisco Secure Firewall Management Center (FMC). Cisco Talos confirms three separate threat clusters exploiting it, alongside CVE-2026-20316, a static-credential flaw.
WHAT ACTUALLY HAPPENED
FMC is the central console that pushes policy to every Cisco Secure Firewall in an estate. Talos tracks three groups inside it:
UAT-12197 — dropped JSP web shells into Tomcat directories, then used a malicious JAR to query FMC's internal database for authentication credentials.
UAT-11823 — overlaps with Sandworm. Modified license files to open Netcat reverse shells and deployed Cyclops Blink, a modular Linux backdoor tied to Russian military intelligence.
UAT-11988 — a Qilin ransomware operation. Logged in with the static credentials behind CVE-2026-20316, ran FMC's own built-in tools for reconnaissance, harvested Active Directory credentials, built SOCKS5 proxies and reverse-SSH tunnels, then encrypted selected endpoints.
Hotfixes are out for both flaws. A broader hardening release is expected this week.
WHY THE CONSOLE CHANGES THE MATH
A compromised endpoint gives an attacker one machine. A compromised firewall manager gives them the map: every rule, every allowed path, every network object, every device it controls.
And it runs as a trusted appliance. No EDR agent. Rarely logged beyond sign-ins. Its traffic to firewalls and directory services looks exactly like normal administration.
Look at what the ransomware crew did not need: new malware for reconnaissance. They used the tools Cisco ships. Living off the land, on the one box built to see everything.
A CVSS 5.3 flaw let a Qilin affiliate in. Severity scores rank bugs. Attackers rank positions.
WHAT TO DO NOW
HOTFIX TODAY, NOT NEXT WINDOW — apply Cisco's FMC hotfixes for both CVEs now, and schedule the hardening release the moment it lands.
TAKE THE CONSOLE OFF THE NETWORK — FMC's web and SSH interfaces should be reachable only from a dedicated management VLAN or jump host, never from user subnets or the internet.
HUNT BEFORE YOU TRUST — check Tomcat directories for unexpected JSP or JAR files, modified license files and unknown outbound connections, using the Talos IOCs and Snort rules.
ROTATE WHAT IT TOUCHED — if FMC was exposed, treat its stored and Active Directory credentials as burned and reset them, starting with service and admin accounts.
Your firewall is only as trustworthy as the console that controls it.
When did someone last check who can reach your firewall manager?