Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos reports that two recently patched Cisco Secure Firewall Management Center vulnerabilities (CVE-2026-20079 and CVE-2026-20316) were exploited by three separate intrusion clusters: one attributed to Qilin ransomware affiliates, one linked to a Sandworm-like APT that deployed Cyclops Blink, and a third focused on credential theft; attackers used web shells, modified license files, reverse tunnels/proxies, and legitimate FMC utilities to perform reconnaissance, exfiltrate data, and achieve persistence, and Cisco has released hotfixes and additional hardening.