Cisco says three threat clusters exploiting Secure Firewall Management Center flaws

Cisco Talos said three clusters of post-compromise activity have exploited two recently patched Secure Firewall Management Center vulnerabilities. CVE-2026-20079, rated CVSS 10.0, is an authentication bypass in the FMC web interface that can let an unauthenticated remote attacker run script files and gain root on the underlying operating system. UAT-12197 used it to deploy JSP web shells and a Java command executor to pull authentication data and credentials. UAT-11823 chained both flaws to deliver a reverse shell, configuration-harvesting scripts and a Cyclops Blink variant previously attributed to Sandworm. UAT-11988 used CVE-2026-20316 for initial access, then living-off-the-land tooling to reconnoiter, tunnel, collect credentials and deploy Qilin ransomware. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog, with federal patch deadline of September 12, 2026.