Cisco FMC Vulnerabilities CVE-2026-20079 and CVE-2026-20316 Exploited in Attacks
Summary
Cisco Talos reports three intrusion clusters exploiting two Cisco FMC flaws for unauthorized access, credential theft, reconnaissance and ransomware deployment. Cisco urges customers to apply hotfixes or block internet access to the management interface.
Key points
- CVE-2026-20079 allows remote unauthenticated attackers to execute commands and gain root access through crafted HTTP requests.
- CVE-2026-20316 uses hard-coded credentials to let remote unauthenticated attackers log in to affected FMC systems.
- Cisco Talos identified three intrusion clusters exploiting one or both flaws; Cisco had flagged the vulnerabilities as exploited in the wild in July 2026.
- One cluster used a web shell and malicious JAR to obtain authentication data and credentials.
- Activity believed linked to Sandworm involved a reverse shell, firewall configuration theft and an implant for credential harvesting and other operations.
- A cluster suspected to involve a Qilin operator used CVE-2026-20316 for reconnaissance, credential theft, additional access and ransomware deployment.
- Cisco recommends applying available hotfixes promptly; temporarily restricting internet access to the FMC management interface is an alternative. A broader hardening release was planned for the week of September 16.
Article Details
- Vulnerability Types
- Authentication bypass
- Use of static hard-coded credentials
- Severity
- CVE-2026-20079 is described as critical; no severity is stated for CVE-2026-20316.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Make the vulnerable FMC management interface inaccessible from the internet.
MITRE ATT&CK
T1003 · OS Credential DumpingThe first cluster obtains user authentication data and credentials, and the Sandworm-linked implant harvests credentials.T1018 · Remote System DiscoveryThe Sandworm-linked implant performs network scanning.T1040 · Network SniffingThe Sandworm-linked implant can perform packet sniffing.T1059 · Command and Scripting InterpreterThe first cluster's malicious JAR enables command execution; the Sandworm-linked implant also executes commands.T1059.004 · Unix ShellThe Sandworm-linked activity establishes a reverse shell to a command-and-control server.T1486 · Data Encrypted for ImpactThe Qilin-linked operator delivers ransomware.T1505.003 · Web ShellThe first intrusion cluster places a malicious web shell in the CSM Tomcat webroot directory.T1552.001 · Credentials In FilesThe Qilin-linked intrusion logs in using static hard-coded credentials for a low-privileged account.T1562.001 · Disable or Modify ToolsThe Qilin-linked operator deploys AV killers.T1590 · Gather Victim Network InformationThe Qilin-linked operator performs network reconnaissance.
CVE
CVE-2026-20079State-sponsored and financially motivated attackers are actively exploiting CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC), using them to gain unauthenticated access and take controlCVE-2026-20316State-sponsored and financially motivated attackers are actively exploiting CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC), using them to gain unauthenticated access and take control