Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
B Cisco Talos Blog ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
Critical authentication bypass vulnerability (CVSS 10.0) is actively exploited by ransomware operators (UAT-11988) who gain initial access via static credentials and abuse legitimate tooling for reconnaissance and lateral movement.
Description
CVE-2026-20079 is a critical authentication bypass vulnerability (CVSS 10.0) in Cisco Secure Firewall Management Center that allows unauthenticated remote attackers to bypass authentication and execute scripts to gain root access to the underlying operating system. CVE-2026-20316 allows remote attackers to log in using a low-privileged account. Cisco Talos documents active exploitation by ransomware group UAT-11988, which uses static credentials for initial compromise, then abuses built-in FMC tools in living-off-the-land fashion for reconnaissance, tunneling, credential harvesting, and endpoint mapping. The attack also deploys Cyclops Blink malware and NetCat-based reverse shells.
Risk score
- cvss base
- 45.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 60.00
- industry weight
- 1.10
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
TTP_SKIPPEDTTP mapping skipped (placeholder or aggregation article) −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0