Cisco firewall software exploitation

In August 2026, a high-severity vulnerability (CVE-2026-20349) was identified as being actively exploited in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. This flaw, carrying a CVSS score of 8.6, allowed unauthenticated remote attackers to trigger a denial-of-service condition via specially crafted HTTP requests.

By September 2026, the situation escalated with the discovery of a maximum-severity authentication bypass vulnerability (CVE-2026-20079) affecting Cisco Secure Firewall Management Center (FMC) software. This flaw carries a CVSS score of 10.0 and enables unauthenticated remote attackers to execute commands with root privileges.

Cisco Talos linked the exploitation of the FMC flaw to three distinct groups: UAT-12197, which plants web shells; an advanced persistent threat actor with tooling overlapping with Sandworm; and UAT-11988, which has been observed deploying Qilin ransomware. Consequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating that federal agencies secure affected systems.