Cisco's security research team, Talos, said on 9 September that it is tracking the exploitation of two flaws in Cisco Secure Firewall Management Center by state-sponsored and criminal groups [1].
The US Cybersecurity and Infrastructure Security Agency listed the more serious flaw, CVE-2026-20079, as exploited the same day, giving federal agencies until 12 September [2].
That flaw lets an unauthenticated, remote attacker bypass authentication and run scripts with root access. It has been known since March, and Cisco scores it 10 out of 10 [3].
What it covers
Unpatched Firewall Management Center systems, which manage Cisco firewalls. The second flaw, CVE-2026-20316, lets an attacker log in with a low-privileged account [1].
Talos describes three clusters of attacks [1]:
- one that planted web shells and stole credentials;
- one it links to a state-sponsored group whose tools overlap with Russia's Sandworm, which installed a variant of the Cyclops Blink malware;
- one it assesses with high confidence to be a ransomware operator, whose methods matched Qilin ransomware affiliates.
Cisco advised customers to apply the fixes it had already released, and said a fuller hardening release would follow the week of 14 September [1].
What it does not tell you
How many organisations were breached, or which ones. The post gives technical indicators, not victims [1].
Who is behind the attacks, beyond Talos's own assessment [1].
Comments