Three Threat Actor Clusters Including Sandworm Are Actively Exploiting Cisco FMC’s CVSS 10.0 Authentication Bypass
Three distinct threat actor clusters are actively exploiting a critical authentication bypass in the Cisco Secure Firewall Management Center (FMC), identified as CVE-2026-20079. Cisco Talos reports that UAT-12197 is deploying web shells and a specific JAR file, cmd.jar, to facilitate credential theft via OmniQuery. Simultaneously, UAT-11823—linked to the Russian APT Sandworm (GRU Unit 74455)—is deploying…