Cisco FMC Vulnerabilities Exploited by Ransomware Gang and State-Sponsored Actors
Two patched Secure Firewall Management Center flaws actively exploited in the wild
Key Takeaways
- Two Cisco FMC vulnerabilities are being actively exploited in the wild.
- Three threat clusters -- including ransomware actors and state-sponsored groups -- are exploiting the flaws.
- Exploitation poses risks of unauthorized access, lateral movement, and ransomware deployment.
- Cisco has released patches; organizations should update to the latest software versions immediately.
Quick answers
- What happened?
- Cisco Talos reports that two recently patched vulnerabilities in the Secure Firewall Management Center (FMC) have been exploited by three separate threat clusters. The exploitation spans both financially motivated ransomware actors and state-sponsored hacking groups, targeting global organizations using Cisco FMC appliances.
- Which products are affected?
- Secure Firewall Management Center (FMC)
- What should defenders do?
- Apply Cisco's released patches for the FMC vulnerabilities immediately. Update to the latest software versions. Monitor for indicators of compromise and review network segmentation to limit lateral movement potential.
Cisco Talos has identified that two recently patched vulnerabilities in the Secure Firewall Management Center (FMC) are being actively exploited in the wild. According to reporting, three separate threat clusters -- including a ransomware gang and state-sponsored actors -- have been observed exploiting these flaws. The exploitation targets Cisco Secure Firewall Management Center (FMC) appliances and has been linked to potential unauthorized access, lateral movement, and ransomware deployment. Cisco has released patches addressing the vulnerabilities, and the company urges organizations to update to the latest software versions to mitigate the risk. The full technical details of the exploitation methods and the specific CVE identifiers remain under investigation.
Security Details
Two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC) are being actively exploited in the wild by three separate threat clusters. The exploitation spans both financially motivated ransomware actors and state-sponsored threat groups, targeting global organizations using Cisco FMC appliances. Risks include unauthorized access, lateral movement, and ransomware deployment. Cisco has released patches; organizations are urged to update to the latest software versions.
Affected products
Secure Firewall Management Center (FMC)
Mitigation
Apply Cisco's released patches for the FMC vulnerabilities immediately. Update to the latest software versions. Monitor for indicators of compromise and review network segmentation to limit lateral movement potential.
Sources
BleepingComputer
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Sep 10, 2026 · 15:43
Original link
Related Security News
Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.
