Redpacketsecurity Critical Cisco FMC Vulnerabilities Under Active Exploitation
Article Content
- •CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0.
- •Active exploitation is confirmed, with attackers using these vulnerabilities to deploy malware and backdoors.
- •Cisco has released patches, but many systems remain vulnerable due to lack of updates.
Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and gain root access by sending crafted HTTP requests. CVE-2026-20316, with a CVSS score of 5.3, enables attackers to log in using static low-privileged credentials. Cisco has confirmed active exploitation of these vulnerabilities, with three distinct clusters of attacks identified, including one attributed to the Russian APT group Sandworm. Patches were released in March and July 2026, but many systems remain unpatched. Organizations are urged to apply the available updates immediately to mitigate the risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (100)
Following this threat?
Track Qilin, Sandworm and Cyclops Blink in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin… 
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure…