Cisco flags active exploitation of critical FMC authentication bypass.

Cisco and CISA confirmed that attackers are exploiting a critical FMC flaw that allows unauthenticated users to run malicious scripts and gain root access through crafted HTTP requests. Cisco patched the issue in March and later added indicators of compromise, then disclosed that exploitation began in August. Talos identified three clusters abusing this and a related FMC bug, including actors deploying web shells, Sandworm delivering Cyclops Blink, and a group linked to Qilin ransomware conducting reconnaissance and credential theft. Administrators are urged to apply available patches and restrict external access to FMC interfaces.

Read more:

https://www.securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation/