Sandworm and a Ransomware Affiliate Are in the Same Firewall Console

Cisco Talos confirmed this week that two vulnerabilities in Cisco Secure Firewall Management Center are under active exploitation by three distinct groups — including one whose tooling overlaps with Sandworm, the Russian state actor, and one assessed as an affiliate of the Qilin ransomware operation. CISA's patch deadline for federal civilian agencies was Saturday, 12 September. It has passed.

The detail worth pausing on is not the severity score. It is what the attackers went after. FMC is not a firewall. It is the console that manages them — the system holding the policy, the configuration and the credentials for an organisation's entire perimeter.

What is broken

CVE-2026-20079 affects FMC releases 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, plus Cisco Security Cloud Control Firewall Management, which Cisco has already patched on its side. Cisco has published hot fixes for every affected version and says there is no workaround — though it notes the severity is reduced where the management interface is not reachable from the internet. Cisco's own advisory states that its PSIRT became aware of active exploitation in August 2026.

CVE-2026-20316 was disclosed on 29 July as an exploited zero-day and added to CISA's Known Exploited Vulnerabilities catalogue at the time.

Three groups, one console

Talos is tracking the intrusions as three separate clusters, which is the part that makes this more than a routine advisory:

• UAT-12197 — crimeware activity, deploying web shells and credential-extraction tooling.
• UAT-11823 — an advanced persistent threat actor whose tooling overlaps with Sandworm, the group linked to Russia's GRU military intelligence. Talos observed it harvesting firewall configurations.
• UAT-11988 — assessed with high confidence as a Qilin ransomware affiliate, using the static credential for reconnaissance and lateral movement.

Three unrelated operations, with entirely different objectives, converged on the same product in the same window. A financially motivated ransomware crew and a state intelligence service do not usually share a target list. Here they did, because the target was too useful to pass up.

Why the management plane

A compromised firewall costs you one enforcement point. A compromised management centre costs you the map.

For Sandworm, harvesting firewall configurations is not a step towards the objective — in an espionage operation it is close to the objective itself. It reveals the network's shape, its segmentation, which paths are trusted and where the sensitive systems sit. For a ransomware affiliate, the same console is the fastest route to reaching everything at once, and to quietly weakening the controls that would otherwise contain the encryption stage.

This is also why "we are not a nation-state target" fails as a reason to patch slowly. The same flaw was worked by both kinds of actor simultaneously. Whichever threat model an organisation writes for itself, the exposure is identical.

The wider pattern

FMC did not appear on CISA's list alone. The same deadline covered an authentication bypass in Citrix NetScaler ADC and Gateway (CVE-2026-19490, CVSS 9.3), where security researchers logged dozens of exploitation attempts against honeypots in early September, and a Fortinet flaw affecting FortiOS, FortiSwitchManager and FortiSASE (CVE-2025-25249, CVSS 7.3), exploited since July.

Cisco, Citrix, Fortinet. Three vendors, three products bought specifically to secure the network edge, all being used as the way in. The category that was supposed to be the control is now reliably the opening.

What to do

• Apply the hot fixes now. They exist for every affected FMC version. Cisco has a broader hardening release scheduled for the week of 16 September, but that is not a reason to wait for it.
• Take the management interface off the internet. It reduces the severity of this specific issue and every future one in the same class. An FMC console should never have been publicly reachable.
• If yours was exposed and unpatched, investigate rather than assume. Exploitation has been running since at least August, and the observed activity included web shells and credential harvesting — meaning patching alone does not evict anyone already inside. Cisco Talos has published indicators of compromise and detection coverage for defenders.
• Check the Citrix and Fortinet products too, if you run them. They were on the same list for the same reason.

The federal deadline is the useful signal here, not the rule. CISA set 12 September because the exploitation was already ongoing. Everyone else is working to the same clock — just without the paperwork.

---

Sources: Cisco Talos — Active exploitation of Cisco Secure Firewall Management Center vulnerabilities · Cisco Security Advisory — CVE-2026-20079 · BleepingComputer — Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers · Help Net Security — Cisco FMC bugs exploited by nation-state and ransomware actors · The Hacker News — CISA flags exploited Cisco, Citrix, Fortinet flaws · CISA — Known Exploited Vulnerabilities Catalog