[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvqBDHNELfwWbGQ9k2TcOnsoTo4j9aYUJGCZ1qoA2vUM":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"481b0c71-f099-4415-90a2-20b9025d50a2","Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware","cisco-fmc-flaws-exploited-to-steal-credentials-and-deploy-qilin-ransomware-788925","Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass","Cisco has reported that three distinct threat groups, including ransomware operators and state-sponsored actors, are actively exploiting two recently patched vulnerabilities in its Secure Firewall Management Center (FMC) software. These flaws, CVE-2026-20079 and CVE-2026-20316, allow for authentication bypass, credential theft, and the deployment of malware, including Qilin ransomware. CISA has added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog, mandating patching for federal agencies.","Cisco FMC flaws exploited by threat actors for credential theft and Qilin ransomware deployment.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisco-fmc-flaws-exploited-to-steal.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgJizB5uHZncQAbfKm3-k256bJHufHNcClzKqXH2XK79HlAw8egcuz3abU_gxrTbR2zrWqpMmFcHApBqp5AvC2uox6vEeOlDt1JdRy-A6WAqpFPfVeZ4hM4gp-lCqqY_hIXMu2VVupFLGzbv1sBXLjQGSPlORsnaEdcOqjLJQKAKfDMHJqGY6KY1NZCLth0\u002Fs1600\u002Fcisco-ransomware.jpg","2026-09-11T06:19:59+00:00","2026-09-11T08:00:04.429808+00:00",9,[17,20,23,26],{"name":18,"type":19},"Secure Firewall Management Center (FMC)","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":25},"Sandworm","threat_actor",{"name":27,"type":28},"JSP web shells","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,45,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2026-20079","Authentication bypass vulnerability in Cisco FMC web interface",{"type":54,"value":58,"context":59},"CVE-2026-20316","Vulnerability allowing login with low-privilege account in Cisco FMC",[21,18],{"controls":62,"vendors":146},[63,92,117],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,101,109],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":93,"product_name":98,"url":99,"description":100},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[147],{"slug":148,"name":21,"logo_path":149,"roles":150},"cisco","\u002Fvendor-logos\u002Fcisco.png",[151,152],"affected","reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"cisco-fmc-vulnerabilities-actively-exploited-for-credential-theft-and-ransomware-deployment","Cisco FMC Vulnerabilities Actively Exploited for Credential Theft and Ransomware Deployment","Three distinct threat groups, including state-sponsored actors and ransomware operators, are actively exploiting two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC) — a security tool that should itself be a defensive stronghold. The flaws enable authentication bypass and credential theft, meaning attackers can circumvent security controls entirely without needing valid credentials. This is particularly damaging because FMC manages firewall policy across an organization, giving attackers a high-value pivot point into network infrastructure. CISA's addition of CVE-2026-20079 to its Known Exploited Vulnerabilities catalog signals that exploitation is widespread and confirmed in the wild, not merely theoretical. The deployment of Qilin ransomware as a follow-on payload underscores how quickly unpatched vulnerabilities in security appliances can escalate to catastrophic business disruption.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","CISA BOD 22-01: Known Exploited Vulnerabilities Catalog","ITIL: Change and Release Management (Emergency Change Procedure)","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]