THREAT OPS › Threat News › Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
<img alt="Active exploitation of Cisco Secure Firewall Management Center vulnerabilities" src="https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/threat_advisory.jpg" /><p>Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, <a href="https://sec.cloudapps.cisco.c
MITRE ATT&CK techniques
Indicators of compromise
- b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77dsha256
- db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8esha256
- 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461sha256
- CVE-2026-20079cve
- CVE-2026-20316cve
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2url
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjhurl
- https://malpedia.caad.fkie.fraunhofer.de/actor/sandwormurl
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdfurl
- https://www.justice.gov/archives/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federationurl
- https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#gsrqurl
- 208.123.119.215ipv4
- 89.34.96.56ipv4
- 104.218.165.253ipv4
- 91.214.78.118ipv4
- 43.204.2.142ipv4
- storage.ghost.iodomain
- java.iodomain
Original source: https://blog.talosintelligence.com/fmc-ongoing-exploitation/