Ransomware gang exploits Cisco flaw in zero-day attacks since January

BleepingComputer

March 18, 2026 at 4:53 PM

Actively Exploited

Ransomware Zero-day Cisco Vulnerability Patch RCE

Overview

The Interlock ransomware gang has been actively exploiting a serious remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC) software since late January. This flaw, classified as having maximum severity, allows attackers to execute arbitrary code on affected systems, putting organizations at significant risk. Companies using this software should be particularly vigilant, as the vulnerability is being exploited in ongoing attacks. Cisco has not yet released a patch to address this issue, which raises concerns about the potential for widespread impact. Organizations relying on Cisco FMC should prioritize security measures and closely monitor any unusual activity to safeguard their networks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Cisco Secure Firewall Management Center (FMC) software
Timeline: Ongoing since late January

Original Article Summary

The Interlock ransomware gang has been exploiting a maximum severity remote code execution (RCE) vulnerability in Cisco's Secure Firewall Management Center (FMC) software in zero-day attacks since late January. [...]

Impact

Cisco Secure Firewall Management Center (FMC) software

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since late January

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware, Zero-day, Cisco, and 3 more.

Read Original Article

Related Coverage

Cisco warns of unpatched AsyncOS zero-day exploited in attacks

BleepingComputer

Cisco has issued a warning regarding a serious zero-day vulnerability in its AsyncOS software that is currently being exploited in the wild. This flaw affects Cisco's Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, leaving customers vulnerable to potential attacks. The zero-day has been classified with maximum severity, indicating the urgency for organizations using these products to take action. As of now, there are no patches available to address this vulnerability, which raises concerns about the security of email communications for affected users. Companies that rely on these Cisco products should closely monitor their systems and implement any available security measures to mitigate risks until a fix is released.

Dec 17, 2025

China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear

SecurityWeek

A new vulnerability, tracked as CVE-2025-20393, has been discovered in Cisco's Secure Email Gateway and Secure Email and Web Manager appliances. This zero-day flaw is reportedly being exploited by hackers linked to China, posing a significant risk to organizations using these products. The vulnerability allows attackers to bypass security controls, potentially leading to unauthorized access and data breaches. Companies using these Cisco appliances should prioritize patching and monitoring their systems to mitigate the risks associated with this exploit. The discovery of this flaw is particularly concerning given the ongoing cyber threats targeting critical infrastructure and enterprise environments.

Dec 18, 2025

China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager

Security Affairs

Cisco has disclosed a critical zero-day vulnerability, tracked as CVE-2025-20393, affecting its Secure Email Gateway and Secure Email/Web Manager products. This vulnerability is currently being exploited by a China-linked advanced persistent threat group known as UAT-9686. The attack campaign began on December 10 and targets specific systems, raising significant concerns for organizations relying on these Cisco products. Users and administrators should be particularly vigilant, as this active exploitation could lead to unauthorized access and data breaches. The urgency of addressing this vulnerability cannot be overstated, given its potential impact on email security and the sensitive information handled by these systems.

Dec 19, 2025

Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released

Help Net Security

Last week, a zero-day vulnerability was discovered in Cisco email security appliances, which has been actively exploited by attackers. This flaw affects multiple versions of Cisco's email security products, putting organizations that rely on these systems at risk of data breaches and unauthorized access. Cisco has acknowledged the issue and is urging users to implement security measures while they work on a patch. The exploitation of this vulnerability raises significant concerns for businesses using Cisco's email solutions, as it could lead to serious security incidents if not addressed promptly. Users should stay vigilant and monitor for any updates from Cisco regarding remediation steps.

Dec 21, 2025

Cisco switches hit by reboot loops due to DNS client bug

BleepingComputer

Several models of Cisco switches are experiencing reboot loops triggered by fatal errors in their DNS client. This issue has been reported by users and confirmed by BleepingComputer, indicating a significant problem that could disrupt network operations for affected organizations. The models impacted include various Cisco switches, which are widely used in enterprise environments. The reboot loops not only lead to downtime but could also complicate network management and security efforts. Ensuring stable and reliable network infrastructure is crucial for businesses, making this bug a serious concern for IT departments.

Jan 8, 2026

Cisco ISE, ISE-PIC flaw patched following PoC exploit release

SCM feed for Latest

Cisco has released updates to address a medium-severity vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector, identified as CVE-2026-20029. This flaw was brought to light following the publication of a proof-of-concept exploit, raising concerns about its potential exploitation. Organizations using these Cisco products are at risk, as the vulnerability could allow unauthorized access or manipulation of identity services. It’s crucial for affected users to apply the updates promptly to safeguard their networks and data from possible attacks. The quick response from Cisco highlights the ongoing need for vigilance in cybersecurity practices.

Jan 9, 2026