Sandworm-linked Cyclops Blink variant targets Cisco FMC via chained flaws

September 15, 2026 at 02:37 AM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A likely Russian threat actor is deploying a new Cyclops Blink variant against Cisco Firewall Management Center devices by chaining two vulnerabilities, CVE-2026-20079 and CVE-2026-20316. Cisco released hotfixes last week and strongly advised immediate patching amid evidence of in-the-wild exploitation.

Key Facts

Cisco identified the Cyclops Blink activity as one of three campaigns involving CVE-2026-20079, a maximum severity authentication bypass, and CVE-2026-20316, a 5.3 CVSS privilege escalation flaw.
The new Cyclops Blink variant runs on 64-bit x86-64 Linux systems, a shift from the original 32-bit PowerPC architecture.
Cisco released hotfixes for both vulnerabilities last week and plans a broader hardened release later this week.
The FBI previously led a court-authorized operation that removed Cyclops Blink from victims' devices.

Attack Chain

Threat actors possibly tied to Sandworm chain CVE-2026-20079 and CVE-2026-20316 to first download a Netcat-based reverse shell and proxy tool on vulnerable FMC systems. They then use that foothold to deploy the new Cyclops Blink variant. CVE-2026-20079 allows an unauthenticated remote attacker to run arbitrary code and gain root access. CVE-2026-20316 enables a remote attacker to log in with low privileges and then escalate privileges using previous FMC vulnerabilities.

Malware Evolution

Cyclops Blink first surfaced in 2022 targeting WatchGuard firewalls and later ASUS devices. Its core functions included beaconing information to command-and-control servers, downloading and executing malicious files, and adding new modules. The malware could persist through reboots and legitimate firmware updates. The latest variant retains many original features while adding new ones, according to Sophos. It now uses generic Linux persistence techniques instead of modifying vendor-specific firmware.