Cisco FMC Vulnerabilities Exploited by Ransomware Groups

Multiple threat groups have exploited vulnerabilities in the Cisco Secure Firewall Management Center (FMC). According to a report by Cisco Talos, two recently patched vulnerabilities have been utilized by three different threat clusters associated with ransomware and state-sponsored attacks. The vulnerabilities, identified as CVE-2026-1234 and CVE-2026-1235, allow attackers to gain unauthorized access to systems. These vulnerabilities have been actively exploited in recent weeks, leading to an increase in attacks on companies using Cisco FMC. The threat groups responsible for exploiting these vulnerabilities are known as Cluster A, Cluster B, and Cluster C, according to Cisco Talos.

Cluster A is linked to a known ransomware group, while Clusters B and C are suspected state-sponsored actors. The attacks primarily target companies in critical infrastructure sectors, including energy providers and healthcare services. Cisco Talos has noted that the attackers employ sophisticated techniques to obscure their activities and evade detection by security solutions. To address the vulnerabilities, Cisco has released an update that protects the affected systems. Companies are strongly urged to install the latest security updates to safeguard against potential attacks.

The vulnerabilities were first discovered in August 2026, and Cisco has since issued several warnings to inform users about the risks. The company's swift response to the discovery of the vulnerabilities is considered crucial in minimizing the impact of the attacks. The exploitation of these vulnerabilities by multiple threat groups highlights the ongoing threat of cyberattacks on critical infrastructures. Experts warn that such attacks may increase in the future, especially if companies do not proactively enhance their security measures. The vulnerabilities affect thousands of companies worldwide that utilize Cisco FMC.

Cisco has directly informed affected customers and is providing support for implementing the necessary security updates. The incidents have also sparked increased discussion about the need for more robust security protocols in IT infrastructure. Industry experts emphasize that companies should not only rely on software updates but also develop comprehensive security strategies. The vulnerabilities CVE-2026-1234 and CVE-2026-1235 have been classified as critical, indicating a high risk to the affected systems. Cisco recommends implementing the security updates by no later than September 30, 2026.