# Two Cisco FMC flaws are being used to harvest credentials and to land Qilin ransomware

Source: https://startwithidentity.com/blog/2026-09-11-cisco-fmc-auth-bypass-feeds-credential-theft-and-qilin/
Last updated: 2026-09-14
License: content by Start with Identity. Cite the source URL.

---

Two Cisco Secure Firewall Management Center flaws are under active exploitation by separate clusters. CVE-2026-20079 (CVSS 10.0) is an authentication bypass in the web interface allowing an unauthenticated remote attacker to execute script files and obtain root; the cluster tracked as UAT-12197 used it to deploy JSP web shells and a JAR-based command executor that queries internal databases for user authentication data and credentials. CVE-2026-20316 (CVSS 5.3) allows unauthenticated login as a low-privilege account and chains for escalation; the UAT-11988 ransomware operation used it for initial access, then ran reconnaissance with FMC's own built-in tooling before deploying Qilin. CISA added CVE-2026-20316 to KEV in late July and CVE-2026-20079 with a September 12, 2026 federal deadline.

## Why it matters

We covered [Cisco FMC shipping with hardcoded credentials](https://startwithidentity.com/blog/2026-07-30-cisco-fmc-static-credentials-actively-exploited/) on July 30. The product is now on its second credential-adjacent exploitation story in six weeks, and the interesting detail this time is what the attackers did after they were in.

They queried the internal database for authentication data. A firewall management console is not just a control plane, it is a credential store: it holds the accounts that administer the firewalls, the directory integrations used to authenticate VPN users, and frequently RADIUS or LDAP bind credentials. Root on the console is therefore a credential harvest, and the intrusion continues long after the box is patched. The Qilin cluster's use of FMC's own tooling for reconnaissance makes the same point from the other side: nothing they ran was malicious software, so detection built on binaries found nothing.

Patch both CVEs. Then treat it as a credential incident: rotate the LDAP and RADIUS bind accounts, the local administrator accounts, and any API keys the console holds, revoke VPN sessions, and look for authenticated activity from accounts whose credentials lived in that database. The technique is [credential manager key extraction](https://startwithidentity.com/techniques/credential-manager-key-extraction/) applied to an appliance rather than a workstation.

Source: [The Hacker News](https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html)