Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Two critical authentication bypass vulnerabilities in Cisco's Secure Firewall Management Center were actively exploited by multiple sophisticated threat groups before organizations could apply available patches. The flaws allowed attackers to completely circumvent authentication controls, giving them a foothold to deploy destructive malware including Qilin ransomware and Cyclops Blink. This is particularly alarming because the compromised product is itself a security management platform — attackers who control the FMC can potentially manipulate firewall policies across an entire network. The incident underscores that security infrastructure is a high-value target and must be treated with the same — if not greater — urgency as general-purpose systems when vulnerabilities are disclosed.