The primary issue is CVE-2026-20079, an authentication bypass in the FMC web interface rated CVSS 10.0. According to Cisco, the flaw could let an unauthenticated, remote attacker bypass authentication protections. Microsoft has attributed exploitation of the FMC flaws to a threat actor tracked as Storm-1175, which used a Qilin ransomware affiliate to move from initial access to credential theft and ransomware deployment.

Microsoft's breakdown of the intrusion chain:

• Storm-1175 exploited the FMC vulnerabilities to gain initial access
• The actor then stole credentials from the compromised environment
• A Qilin ransomware affiliate was engaged to deploy ransomware and pressure victims

The campaign highlights how quickly authentication bypass flaws in management infrastructure can be converted into full domain compromise. FMC sits at the center of firewall policy and device management, so access to it is a high-value foothold.

Mitigation priorities for defenders:

• Patch FMC immediately if you have not already applied the vendor fixes
• Audit FMC management interfaces for exposure to untrusted networks
• Check for signs of credential theft and anomalous access tied to FMC administrators
• Review environments for Qilin ransomware indicators and lateral movement from management infrastructure

Admins running FMC should treat this as urgent, particularly where the management plane is internet-adjacent or reachable from less-trusted segments. If you have not confirmed your patch status, do so before anything else.

Source: The Hacker News

Has your organization already patched FMC, and have you seen any signs of Storm-1175 or Qilin activity in your logs?