Cisco's security research division, **Cisco Talos**, has revealed that two recently patched vulnerabilities in **Cisco Secure Firewall Management Center (FMC)** have been actively exploited in the wild. These exploits have been attributed to three separate threat clusters, including those associated with ransomware operations and state-sponsored attacks. The vulnerabilities in question are **CVE-2026-20079**, a maximum-severity authentication bypass flaw, and **CVE-2026-20316**, a static credential vulnerability. The exploitation of these flaws has allowed attackers to deploy web shells, exfiltrate credentials, create reverse shells and proxies, and in some instances, deploy sophisticated malware like **Qilin ransomware** and **Cyclops Blink**. "Talos' analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors," **Cisco Talos** stated. The company is tracking these clusters as **UAT-12197**, **UAT-11823**, and **UAT-11988**.  **CVE-2026-20079** carries a critical CVSS score of 10.0, enabling unauthenticated, remote attackers to bypass authentication and execute scripts with root privileges on vulnerable FMC devices. **CVE-2026-20316**, while having a CVSS score of 5.3, is rated as High severity by Cisco due to its potential to be chained with other FMC vulnerabilities for privilege escalation. This flaw permits attackers to log in to FMC using static credentials assigned to a low-privileged account. Cisco has already released hotfixes for both vulnerabilities and strongly urges customers to install them immediately. A more comprehensive hardening package, addressing additional vulnerabilities, is also slated for release next week. ## Qilin Ransomware Deployed After FMC Breach One of the intrusion clusters, identified as **UAT-11988**, has been attributed with high confidence by Talos to affiliates of the **Qilin ransomware** group. This threat actor gained initial access to an FMC device utilizing the static credentials associated with **CVE-2026-20316**. Subsequently, they abused legitimate built-in FMC tools to conduct extensive reconnaissance of the victim's network. During this phase, the attackers gathered critical information, including hostnames, IP addresses, directory listings, **Active Directory** service account credentials, **MySQL** credentials, domain account information, computer lists, and hostname-to-IP address mappings for internal servers and infrastructure. This collected data was then staged in publicly accessible files on the compromised FMC server and exfiltrated via HTTP GET requests. To maintain persistent access to internal systems, the attackers deployed a Python SOCKS5 proxy and a reverse SSH tunnel, forwarding ports for services such as LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM. Post-exploitation, the threat actor utilized a suite of tools, including **Impacket**, **Invoke-TheHash**, and custom EDR evasion tools. The ultimate objective was achieved through the deployment of **Qilin ransomware** on endpoints, leading to file encryption. ## APT Hackers Deploy Cyclops Blink A second intrusion cluster, tracked as **UAT-11823**, has been confidently linked by Talos to an advanced persistent threat (APT) actor whose toolkit shows significant overlap with the notorious **Sandworm** APT group. **Sandworm** is a Russian state-sponsored hacking group, widely believed to be affiliated with Russia's military intelligence agency, GRU. The group is infamous for its history of destructive cyberattacks targeting governments and critical infrastructure. The attackers gained access to FMC devices either by exploiting **CVE-2026-20079** or by leveraging the static credentials associated with **CVE-2026-20316**. Upon gaining access, the threat actors modified a `license.tmp` file to establish a **Netcat**-based reverse shell, connecting back to their command-and-control infrastructure. This malicious license file was then executed with root privileges using Cisco's legitimate `package_info.pl` utility. Talos believes that **UAT-11823** exploited both **CVE-2026-20079** and **CVE-2026-20316** during these attacks. The group also deployed scripts to collect configuration data from managed devices, storing it in archives for later exfiltration. Ultimately, **UAT-11823** deployed a variant of **Cyclops Blink** on compromised devices. **Cyclops Blink** is a modular Linux malware family previously attributed to the Russian **Sandworm** threat group. This variant functions as a backdoor, providing persistent access, credential theft capabilities, and the ability to sniff network traffic. ## Third Cluster Focuses on Credential Theft The third cluster, identified as **UAT-12197**, exploited **CVE-2026-20079** to deploy a JSP-based web shell into the **Cisco Security Manager Tomcat** webroot directory. This web shell was then used to install a malicious JAR file named `cmd.jar`, enabling the attackers to execute arbitrary commands on the compromised server. Utilizing this JAR file, the attackers queried internal databases to steal user authentication data and credentials. ## Confirmation of July Attacks Link The **Talos** report also provides crucial answers regarding the ongoing exploitation of these two vulnerabilities, which were initially disclosed in July. As reported on July 29, Cisco initially disclosed that **CVE-2026-20316** was being actively exploited, cautioning that it could be chained with other FMC vulnerabilities for privilege escalation. Concurrently, Cisco updated its advisory for **CVE-2026-20079** to include the same `/var/tmp/license.tmp` indicator of compromise (IoC) as **CVE-2026-20316**. However, at that time, Cisco did not explicitly confirm whether the authentication bypass flaw was also being exploited. Questions were raised regarding the connection between the two vulnerabilities, the active exploitation of **CVE-2026-20079**, and the reason for the identical IoC across both advisories. Cisco's response at the time was a general statement urging customers to install hotfixes promptly. **Talos** has now unequivocally confirmed that **UAT-11823** exploited both **CVE-2026-20079** and **CVE-2026-20316**, and indeed utilized the malicious `license.tmp` mechanism during its attacks, validating the earlier suspicions.