HackerFeeds

CyberSecurity News

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

The Hacker News
· September 11, 2026
RansomwareVulnerabilitiesNation-State

AI summary

Cisco has disclosed that threat actors from three distinct clusters, associated with ransomware and state-sponsored attacks, are exploiting two vulnerabilities in the Secure Firewall Management Center. These vulnerabilities include an authentication bypass flaw that allows an unauthenticated remote attacker to bypass security. The authentication bypass vulnerability has a CVSS score of 10.0 and is identified as CVE-2026-20079. The exploitation of these flaws can lead to the theft of credentials and the deployment of Qilin ransomware. The vulnerabilities were recently patched by Cisco.

Vulnerabilities mentioned

CVE-2026-20079
CRITICAL
CVSS 10
CISA KEV

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. 

Threat groups mentioned

qilin
2,268 victims
active since 2022

Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.

Read the full article at The Hacker Newsthehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.