Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos reports active, in-the-wild exploitation of two Cisco Secure FMC vulnerabilities (CVE-2026-20079 — CVSS 10.0 — and CVE-2026-20316) used across three intrusion clusters: UAT-12197 (web shell and JAR-based credential theft), UAT-11823 (Netcat reverse shells and Cyclops Blink implant attributed to Sandworm), and UAT-11988 (Qilin ransomware operator performing reconnaissance, tunneling, credential theft, and ransomware deployment). The report provides technical details, IOCs (hashes and C2 IPs), Snort SIDs, and mitigation guidance including hotfixes and a forthcoming hardening release.