Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Executive summary
Cisco has warned that multiple threat clusters, including operators linked to the Qilin ransomware group and state-sponsored threat actors, are actively exploiting critical vulnerabilities in Cisco Secure Firewall Management Center (FMC). The primary attack vector is CVE-2026-20079 (CVSS 10.0), a remote unauthenticated authentication bypass flaw in the web management interface. Successful exploitation grants full administrative control over managed firewalls, enabling credential theft, security monitoring evasion, and network-wide ransomware deployment.
Technical analysis
The vulnerability exists in the web server tier of Cisco Secure Firewall Management Center, where improper session validation logic allows an attacker to bypass authentication without valid credentials. In observed campaigns, actors send malformed HTTP requests to exposed management interfaces, acquire administrative session privileges, and export configuration databases containing stored credentials and network topologies. In subsequent phases, the actors pivot to internal active directory infrastructure, disable endpoint telemetry, and deploy Qilin ransomware across virtualized infrastructure and backup repositories.
IOCs
No public IOC is available.
CVEs and affected products
Authentication bypass vulnerability in Cisco Secure Firewall Management Center web interface allowing unauthenticated remote access.
ATT&CK mapping
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.95
⚠️ This report documents public threat intelligence regarding active exploitation in the wild.
⚠️ No private telemetry from customer deployments is referenced.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
3 references
▼
Evidence is derived from public security advisories, Cisco Talos incident reporting, and public CTI disclosure highlighting observed weaponization by ransomware syndicates.
Cisco revealed that threat clusters linked to Qilin ransomware and state-sponsored attacks have exploited Cisco FMC flaws to steal credentials and deploy ransomware.
The attacks leverage CVE-2026-20079 with CVSS score 10.0, an authentication bypass vulnerability in the web interface of Cisco Secure Firewall Management Center software allowing unauthenticated remote access.
Threat actors weaponized the authentication bypass flaw on exposed management portals to extract administrator credentials, pivot laterally across perimeter firewalls, and execute double-extortion ransomware payloads.