Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center FMC vulnerabilities. The attacks leverage CVE-2026-20079 CVSS score: 10.0, an authentication bypass vulnerability in...

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco's Secure Firewall Management Center FMC Software. First, CVE-2026-20079 is an authentication bypass vulnerability in unpatched instances of Cisco's Secure FMC Software, which allows an unauthenticated, remote attack...

Exploit for CVE-2026-20079

CVE-2026-20079 Cisco Secure FMC PoC Python proof of concept f...

Exploit for CVE-2026-20079

CVE-2026-20079 — Cisco FMC Authentication Bypass Descripti...

Cisco Secure Firewall Management Center Authentication Bypass RCE

This module exploits CVE-2026-20079, an authentication bypass in the web interface of Cisco Secure Firewall Management Center FMC. It upgrades a boot-created machine session, obtains its session-specific action token, writes a Makeself-compatible shell script, and executes the selected command...