Sandworm and a Qilin Affiliate Both Hit the Same Cisco Bug

[No credentials required, network access to the web interface only] Three separate hacking clusters, one Cisco Talos ties to the Russian state-sponsored group Sandworm and another it identifies as a Qilin ransomware affiliate, exploited a maximum-severity bug in Cisco's Secure Firewall Management Center before Cisco's own security team confirmed active attacks in August, according to a Talos analysis published Sept. 9.

Cisco tracks the bug as CVE-2026-20079 and rates it 10.0 out of 10 on the CVSS severity scale, the maximum the scale allows. Cisco's advisory, first published March 4, said Cisco had no evidence at the time that the flaw was being exploited. Cisco's Product Security Incident Response Team said it became aware of active exploitation in August, five months after the fix shipped.

The timeline may run longer than Cisco's own account suggests. BleepingComputer reported that log indicators tied to the intrusions date to July 23, three weeks before Cisco's security team says it noticed anything.

Three clusters, one unauthenticated bug

Talos calls the flaw an improperly created system process at boot time that lets an attacker send crafted HTTP requests bypassing the login flow entirely, then execute scripts as root. It found three distinct groups already using that access:

Cluster	Attributed to	What it did
UAT-12197	Credential-theft crew	Planted a JSP web shell in a Tomcat webroot, stole authentication data from internal databases
UAT-11823	Sandworm (high confidence)	Built a Netcat reverse shell, deployed a Cyclops Blink malware variant
UAT-11988	Qilin ransomware affiliate	Used stolen Active Directory and MySQL credentials, deployed Qilin ransomware on endpoints

Why Talos named a Russian military intelligence group

Talos said UAT-11823's "tooling overlaps" with Sandworm, a group the United States and United Kingdom have attributed to Russia's GRU military intelligence service, based on a variant of Cyclops Blink malware previously linked to the same group. That variant persists via scripts in /etc/init.d/, resolves its command server over DNS-over-HTTPS, harvests credentials and sniffs network traffic, according to Talos.

A second, lower-scored bug got the ransomware crew in

The Qilin-linked cluster, UAT-11988, did not need CVE-2026-20079 at all. It logged in using CVE-2026-20316, a static-credential flaw Cisco rates only 5.3, then used Impacket, Invoke-TheHash and custom EDR-killing tools to move toward deploying ransomware, per Talos and BleepingComputer's Sept. 10 report. The lower score did not stop it from opening the same management console the 10.0 bug does.

What to patch, and what CISA's deadline covers

Cisco lists no workaround; administrators must apply one of six hotfixes by release branch, covering versions from 7.0 through 10.0. Firewall Device Manager, ASA Software and FTD Software are unaffected, and Cisco's SaaS-hosted Security Cloud Control Firewall Management was already patched automatically. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on Sept. 9, the same week it catalogued flaws in JFrog's Artifactory, giving federal civilian agencies until Sept. 12 to patch. Private operators face no deadline, though the same crafted request works against any exposed FMC interface.

What Cisco has not said

Cisco has not published indicators of compromise for the July intrusions BleepingComputer traced, and has not said whether that earlier activity belongs to any of the three clusters Talos has now named. It is the same shape of exposure CISA flagged in September for a ConnectWise ScreenConnect flaw: remote-management software with a path to full control that needs no valid account.