Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass

Report facts: Cisco disclosed that multiple threat clusters, including ransomware and state-linked actors, are exploiting two recently patched Cisco Secure Firewall Management Center (FMC) vulnerabilities, notably CVE-2026-20079, an unauthenticated remote authentication bypass flaw with a CVSS score of 10.0, to steal credentials and deploy Qilin ransomware. RealGround analysis: While the reported exploit targets network security infrastructure rather than AI models directly, similar vulnerabilities in systems that manage or front-end AI services could enable attackers to compromise authentication, pivot into AI environments, exfiltrate data, and tamper with AI configurations or model supply chains. Organizations should treat high-severity management-plane vulnerabilities as critical to their AI supply chain, ensuring rigorous patch management, SBOM-driven dependency tracking, and hardening of administrative interfaces that may control or integrate with AI agents and services.