🔴 Critical: Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
-
Cisco has disclosed that three separate threat clusters are exploiting two recently patched vulnerabilities in Secure Firewall Management Center (FMC). The activity spans both ransomware operations and state-sponsored intrusions, making this a broad and active campaign rather than an isolated incident.
The primary issue is CVE-2026-20079, an authentication bypass in the FMC web interface rated CVSS 10.0. According to Cisco, the flaw could let an unauthenticated, remote attacker bypass authentication protections. Microsoft has attributed exploitation of the FMC flaws to a threat actor tracked as Storm-1175, which used a Qilin ransomware affiliate to move from initial access to credential theft and ransomware deployment.
Microsoft's breakdown of the intrusion chain:
- Storm-1175 exploited the FMC vulnerabilities to gain initial access
- The actor then stole credentials from the compromised environment
- A Qilin ransomware affiliate was engaged to deploy ransomware and pressure victims
The campaign highlights how quickly authentication bypass flaws in management infrastructure can be converted into full domain compromise. FMC sits at the center of firewall policy and device management, so access to it is a high-value foothold.
Mitigation priorities for defenders:
- Patch FMC immediately if you have not already applied the vendor fixes
- Audit FMC management interfaces for exposure to untrusted networks
- Check for signs of credential theft and anomalous access tied to FMC administrators
- Review environments for Qilin ransomware indicators and lateral movement from management infrastructure
Admins running FMC should treat this as urgent, particularly where the management plane is internet-adjacent or reachable from less-trusted segments. If you have not confirmed your patch status, do so before anything else.
Source: The Hacker News
Has your organization already patched FMC, and have you seen any signs of Storm-1175 or Qilin activity in your logs?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login