Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware

Part of the CVE-2026-20079 story · since 4 Mar

Quiet for 6 weekslast report 17 Sep14 articles7 outlets
4 Mar · Security Affairs first1 Jul10 Aug19 SepNowThis article11th of 14
  • Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 23:28 UTC. SecurityOnline, its first report on the story. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 01:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 11:36 UTC. The Hacker News, its first report on the story. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV. This article, 11th of 14.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.

Cisco says three distinct threat clusters tied to ransomware and state‑sponsored activity have been exploiting two recently patched Cisco Secure Firewall Management Center (FMC) vulnerabilities. The first flaw, CVE-2026-20079, is an authentication bypass in the FMC web interface with a CVSS v3 score of 10.0, potentially allowing an unauthenticated remote attacker to bypass authentication and run scripts to obtain root access.

The second, CVE-2026-20316 (CVSS 5.3), could let an unauthenticated, remote attacker log in with a low‑privilege account to access sensitive data and can be chained with other FMC flaws to raise privileges.

Cisco Talos has observed three post‑compromise activity clusters on FMC deployments associated with state‑sponsored groups and crimeware operators, including JSP web shells, a Java ARchive (JAR) based command executor, a Netcat reverse shell, and several credential‑harvesting and configuration‑dumping scripts, with a variant of Cyclops Blink noted in one cluster.

A ransomware operation (UAT‑11988) used CVE-2026-20316 for initial access, then leveraged FMC tooling in a living‑off‑the‑land technique to enumerate the environment, drop tunnelling tools, steal credentials, and deploy Qilin ransomware on targeted endpoints.

Users are urged to apply Cisco’s hotfixes for the affected FMC releases and await a forthcoming hardening release. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, with federal agencies required to apply the patches by 12 September 2026; CVE-2026-20316 was added to KEV in late July 2026.

The developments underscore the need for prompt patching and vigilant monitoring of FMC deployments to mitigate post‑compromise activity and ransomware deployment.

How the story developed

All 14 articles
Quiet for 6 weekslast report 17 Sep14 articles7 outlets

14 articles from 7 outlets since 4 Mar. Quiet since 17 Sep. This was the 11th report, 190 days after the first.

Now4 Mar4 Aug142128381421284915First reportSecurity Affairs · 4 Mar, 22:51This article11th of 14 · day 191
  • Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear. Cites a CVE in CISA KEV.
  • Wed 9 Sep, 23:28 UTC. SecurityOnline, its first report on the story. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 01:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 11:36 UTC. The Hacker News, its first report on the story. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV. This article, 11th of 14.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Wed 4 MarDay 01
    1. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access22:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
  2. Thu 5 MarDay 13
    1. Cisco patches 50 flaws after authentication bypass CVE-2026-2007908:56 · SecurityWeek · Known exploited CVE
    2. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass10:57 · Infosecurity · Known exploited CVE
    3. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass20:43 · Dark Reading · Known exploited CVE

  3. Quiet for 22 weeks

    Thu 6 AugDay 1551
    1. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear07:51 · SecurityWeek · Picked up again · Known exploited CVE

  4. Quiet for 5 weeks

    Wed 9 SepDay 1891
    1. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access23:28 · SecurityOnline · Picked up again · Known exploited CVE
  5. Thu 10 SepDay 1904
    1. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access01:32 · CISA · official · CISA alert · Known exploited CVE
    2. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Known exploited CVE
    3. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack11:36 · The Hacker News · Known exploited CVE
    4. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day19:46 · Security Affairs · Known exploited CVE
  6. Fri 11 SepDay 1912
    1. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware07:48 · The Hacker News · Known exploited CVE · This article, 11th of 14
    2. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE

  7. Quiet for 3 days

    Mon 14 SepDay 1941
    1. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Picked up again · Known exploited CVE

  8. Quiet for 3 days

    Thu 17 SepDay 1971
    1. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation12:30 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in