--- title: Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by... description: Cisco has confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center (FMC) that lets... canonical: https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by Sandworm and others to deploy Cyclops Blink, ransomware | daily.dev og:description: Cisco has confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center (FMC) that lets... og:url: https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi og:image: https://api.daily.dev/og/posts/ZbxZGEpwi.png og:image:alt: Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by Sandworm and others to deploy Cyclops Blink, ransomware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by Sandworm and others to deploy Cyclops Blink, ransomware **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary Cisco has confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center (FMC) that lets unauthenticated attackers run root commands; no workarounds exist, only patches. Exploitation likely began around July 23, chained with a static-credential flaw (CVE-2026-20316) sharing indicators of compromise. CISA added the CVE to its KEV catalog with a September 12, 2026 federal patch deadline. Sophos attributes the main campaign to Sandworm, a Russian state-sponsored group, deploying an upgraded 64-bit Linux version of Cyclops Blink malware with new scanning, packet capture, and credential collection capabilities. Separate clusters are exploiting the same flaws to deploy web shells, credential stealers, and Qilin ransomware. The latest Metasploit release now ships a working exploit module for the bug, alongside modules for SonicWall SMA1000, JetBrains TeamCity, Langflow, PaperCut, SimpleHelp, and Next.js RCEs. Cisco urges immediate patching, warning hotfixes won't remediate already-compromised devices. ## Content ## What happened Cisco has confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass flaw in Secure Firewall Management Center (FMC) software. An unauthenticated attacker can send a crafted HTTP request and execute arbitrary commands as root. There are no workarounds — only patches. The vulnerability was first disclosed in March 2026 with no known exploitation at the time. Cisco's PSIRT became aware of active attacks in August, though evidence tied to a related advisory suggests exploitation may have started as early as July 23. ## The related flaw CVE-2026-20316, a static credential vulnerability in the same product, was disclosed in a separate July advisory and is also being exploited in the wild. The two CVEs share indicators of compromise and identical hotfixes, which is how researchers pieced together the earlier exploitation timeline. Chaining the two flaws gives attackers a reliable path from unauthenticated access to full root control. ## Who's behind it Sophos attributes one of the active campaigns to Sandworm, the Russian state-sponsored group, with moderate confidence. The attackers are using the chained CVEs to deploy an upgraded version of Cyclops Blink, the botnet malware previously associated with Sandworm. The new variant is notable for a few reasons: - It runs on 64-bit x86-64 Linux rather than the original 32-bit PowerPC architecture - It uses standard Linux persistence mechanisms instead of firmware modification - It adds network scanning, packet capture, and expanded credential collection Two other threat clusters are separately exploiting the same vulnerabilities to deploy web shells, credential-stealing tools, and Qilin ransomware. So this isn't a single targeted campaign — multiple actors are piling on. ## Government response CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog. Federal agencies have until September 12, 2026 to patch affected systems. ## Metasploit module now available The latest Metasploit release (sixteen new modules total) includes a working exploit for the Cisco FMC authentication bypass RCE. That lowers the bar considerably for less sophisticated attackers. The same release adds exploits for SonicWall SMA1000, JetBrains TeamCity, Langflow AI, PaperCut NG/MF, and Next.js — several of which are also on the CISA KEV list. ## What to do Cisco has released hotfixes and is working on a broader hardened release. One important caveat: hotfixes won't remediate devices that are already compromised. If you haven't patched yet, assume you need to investigate before patching, not just patch and move on. Given that Sandworm is involved and ransomware groups are also exploiting the same flaws, the window for "we'll get to it" has closed. ## Questions this post answers ### What is CVE-2026-20079 and how does it affect Cisco Secure Firewall Management Center? CVE-2026-20079 is a CVSS 10.0 authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) that lets unauthenticated attackers execute root commands via crafted HTTP requests. There are no workarounds, only patches or hotfixes. Cisco confirmed active exploitation by August 2026, though evidence suggests attacks may have started around July 23, 2026. _Teams running Cisco FMC track active exploitation details like this through daily.dev to prioritize patching._ ### Who is exploiting the Cisco FMC vulnerabilities and what malware are they deploying? Sophos attributes the primary campaign to Sandworm, a Russian state-sponsored group, which chains CVE-2026-20079 with the static-credential flaw CVE-2026-20316 to deploy an upgraded Cyclops Blink botnet variant running on 64-bit x86-64 Linux with new scanning, packet capture, and credential collection features. Two other clusters exploit the same CVEs to deploy web shells, credential stealers, and Qilin ransomware. _Security teams tracking Sandworm and Cyclops Blink activity follow threat attribution updates like this on daily.dev._ ### Does Metasploit have an exploit module for the Cisco FMC authentication bypass CVE-2026-20079? Yes, the latest Metasploit release includes a working exploit module for the Cisco FMC authentication bypass RCE, part of sixteen new modules total, five of which target CVEs on the CISA Known Exploited Vulnerabilities list. Other new modules cover SonicWall SMA1000, JetBrains TeamCity, Langflow, PaperCut, SimpleHelp, and a Next.js unauthenticated RCE on Windows servers. _Pentesters and defenders evaluating new Metasploit exploit coverage check release notes like these via daily.dev._ ## Similar posts on daily.dev - [Cisco warns of FMC static credential flaw exploited in zero-day attacks](https://daily.dev/posts/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks-k9spsc6ak) · BleepingComputer · 0 upvotes · 0 comments - [Attackers exploiting unpatched Cisco SD-WAN flaw](https://daily.dev/posts/attackers-exploiting-unpatched-cisco-sd-wan-flaw-flftxgm0p) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by Sandworm and others to deploy Cyclops Blink, ransomware","url":"https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi"},"datePublished":"2026-09-14T22:27:49.112Z","dateModified":"2026-09-17T12:44:46.810Z","description":"Cisco has confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center (FMC) that lets...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e90e464c788cde29bc815bbab9f49817?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e90e464c788cde29bc815bbab9f49817?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Cisco FMC auth bypass flaw (CVE-2026-20079) exploited by Sandworm and others to deploy Cyclops Blink, ransomware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-fmc-auth-bypass-flaw-cve-2026-20079-exploited-by-sandworm-and-others-to-deploy-cyclops-blink-zbxzgepwi#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-20079 and how does it affect Cisco Secure Firewall Management Center?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-20079 is a CVSS 10.0 authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) that lets unauthenticated attackers execute root commands via crafted HTTP requests. There are no workarounds, only patches or hotfixes. Cisco confirmed active exploitation by August 2026, though evidence suggests attacks may have started around July 23, 2026. Teams running Cisco FMC track active exploitation details like this through daily.dev to prioritize patching."}},{"@type":"Question","name":"Who is exploiting the Cisco FMC vulnerabilities and what malware are they deploying?","acceptedAnswer":{"@type":"Answer","text":"Sophos attributes the primary campaign to Sandworm, a Russian state-sponsored group, which chains CVE-2026-20079 with the static-credential flaw CVE-2026-20316 to deploy an upgraded Cyclops Blink botnet variant running on 64-bit x86-64 Linux with new scanning, packet capture, and credential collection features. Two other clusters exploit the same CVEs to deploy web shells, credential stealers, and Qilin ransomware. Security teams tracking Sandworm and Cyclops Blink activity follow threat attribution updates like this on daily.dev."}},{"@type":"Question","name":"Does Metasploit have an exploit module for the Cisco FMC authentication bypass CVE-2026-20079?","acceptedAnswer":{"@type":"Answer","text":"Yes, the latest Metasploit release includes a working exploit module for the Cisco FMC authentication bypass RCE, part of sixteen new modules total, five of which target CVEs on the CISA Known Exploited Vulnerabilities list. Other new modules cover SonicWall SMA1000, JetBrains TeamCity, Langflow, PaperCut, SimpleHelp, and a Next.js unauthenticated RCE on Windows servers. Pentesters and defenders evaluating new Metasploit exploit coverage check release notes like these via daily.dev."}}]} ```