Dark ReadingJai Vijayan
Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink
Part of the CVE-2026-20079 story · since 4 Mar
- Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
- Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
- Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
- Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
- Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline, its first report on the story. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 01:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Thu 10 Sep, 11:36 UTC. The Hacker News, its first report on the story. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
- Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV. This article, 13th of 14.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
A likely Russia-linked threat actor is exploiting two vulnerabilities in Cisco Secure Firewall Management Centre (FMC) to deploy an updated version of the Cyclops Blink malware. Sophos and Cisco Talos identified the activity, while Sophos attributed it with high confidence to Russia-nexus actors and only moderate confidence to Sandworm, citing no conclusive evidence directly linking the group to the 2026 deployments.
The vulnerabilities are CVE-2026-20079, a maximum-severity authentication bypass allowing unauthenticated remote code execution and root access, and CVE-2026-20316, a CVSS 5.3 flaw that permits low-privilege remote access and can be combined with earlier FMC flaws for privilege escalation. Attackers reportedly use the chain to install a Netcat-based reverse shell and proxy before deploying Cyclops Blink.
Cisco said it had evidence of exploitation in the wild and released hotfixes for both flaws in the week before 14 September 2026. It strongly urged affected organisations to apply them immediately, ahead of a broader hardened FMC release planned for later that week. Cisco also reported two other exploitation clusters: UAT 12197, which uses CVE-2026-20079 to install web shells and a Java command-execution tool for credential theft, and UAT 11988, which uses CVE-2026-20316 to distribute Qilin ransomware.
The new Cyclops Blink variant runs on 64-bit x86-64 Linux rather than the original 32-bit PowerPC architecture, uses generic SysV persistence, and adds network scanning, selective packet capture and collection of password hashes, process command lines, CPU details and configuration data.
How the story developed
14 articles from 7 outlets since 4 Mar. Quiet since 17 Sep. This was the 13th report, 194 days after the first.
- Wed 4 Mar, 22:51 UTC. Security Affairs, first report. Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access. Cites a CVE in CISA KEV.
- Thu 5 Mar, 08:56 UTC. SecurityWeek, its first report on the story. Cisco patches 50 flaws after authentication bypass CVE-2026-20079. Cites a CVE in CISA KEV.
- Thu 5 Mar, 10:57 UTC. Infosecurity, its first report on the story. Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass. Cites a CVE in CISA KEV.
- Thu 5 Mar, 20:43 UTC. Dark Reading, its first report on the story. Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass. Cites a CVE in CISA KEV.
- Thu 6 Aug, 07:51 UTC. SecurityWeek. Cisco fixes critical flaws in Catalyst SDWAN and firewall gear. Cites a CVE in CISA KEV.
- Wed 9 Sep, 23:28 UTC. SecurityOnline, its first report on the story. Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 01:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access. Cites a CVE in CISA KEV.
- Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
- Thu 10 Sep, 11:36 UTC. The Hacker News, its first report on the story. CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack. Cites a CVE in CISA KEV.
- Thu 10 Sep, 19:46 UTC. Security Affairs. CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News. Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware. Cites a CVE in CISA KEV.
- Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
- Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV. This article, 13th of 14.
- Thu 17 Sep, 12:30 UTC. SecurityWeek. Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 14 articles as a listHide the list
- Wed 4 MarDay 01
- Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access22:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
- Thu 5 MarDay 13
- Cisco patches 50 flaws after authentication bypass CVE-2026-2007908:56 · SecurityWeek · Known exploited CVE
- Cisco fixes 48 Secure Firewall flaws; CVE-2026-20079 auth bypass10:57 · Infosecurity · Known exploited CVE
- Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass20:43 · Dark Reading · Known exploited CVE
Quiet for 22 weeks
Thu 6 AugDay 1551- Cisco fixes critical flaws in Catalyst SDWAN and firewall gear07:51 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 5 weeks
Wed 9 SepDay 1891- Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access23:28 · SecurityOnline · Picked up again · Known exploited CVE
- Thu 10 SepDay 1904
- CISA Flags Actively Exploited Cisco Firewall Flaw Enabling Root Access01:32 · CISA · official · CISA alert · Known exploited CVE
- Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Known exploited CVE
- CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack11:36 · The Hacker News · Known exploited CVE
- CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day19:46 · Security Affairs · Known exploited CVE
- Fri 11 SepDay 1912
- Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware07:48 · The Hacker News · Known exploited CVE
- Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE
Quiet for 3 days
Mon 14 SepDay 1941- Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Picked up again · Known exploited CVE · This article, 13th of 14
Quiet for 3 days
Thu 17 SepDay 1971- Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation12:30 · SecurityWeek · Picked up again · Known exploited CVE