Three Threat Actor Clusters Including Sandworm Are Actively Exploiting Cisco FMC’s CVSS 10.0 Authentication Bypass

Three distinct threat actor clusters are actively exploiting a critical authentication bypass in the Cisco Secure Firewall Management Center (FMC), identified as CVE-2026-20079. Cisco Talos reports that UAT-12197 is deploying web shells and a specific JAR fil