Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Three distinct threat groups, including state-sponsored actors and ransomware operators, are actively exploiting two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC) — a security tool that should itself be a defensive stronghold. The flaws enable authentication bypass and credential theft, meaning attackers can circumvent security controls entirely without needing valid credentials. This is particularly damaging because FMC manages firewall policy across an organization, giving attackers a high-value pivot point into network infrastructure. CISA's addition of CVE-2026-20079 to its Known Exploited Vulnerabilities catalog signals that exploitation is widespread and confirmed in the wild, not merely theoretical. The deployment of Qilin ransomware as a follow-on payload underscores how quickly unpatched vulnerabilities in security appliances can escalate to catastrophic business disruption.