Trust & Security
Three Threat Actor Clusters Including Sandworm Are Actively Exploiting Cisco FMC’s CVSS 10.0 Authentication Bypass
Cisco Talos identifies Sandworm, Qilin, and a credential theft cluster actively exploiting CVE-2026-20079. The management plane—the control layer for firewalls and VPN policies—is now the authentication gap's primary target.
◆ Heath Callahan