Today’s Field Note

Two edge appliances are on fire today, and both were already patched, which means the only people getting hit are the ones who waited. Cisco confirmed three separate clusters (ransomware and state-sponsored) exploiting FMC bugs CVE-2026-20079, a CVSS 10.0 unauthenticated auth bypass in the web UI, to steal credentials and drop Qilin ransomware. Meanwhile a Russian-speaking actor pointed hundreds of AI agents at PaperCut NG/MF, building and testing exploits at machine speed and reaching 395 organizations; PaperCut just replaced its emergency patches with proper maintenance releases (26.0.5, 25.0.13, 24.1.10). The AI angle is not marketing this time, it is throughput. The takeaway is the boring one you already know: internet-facing management planes are the front door, and patch latency is the whole game.

Today’s Action

  • Patch Cisco FMC now for CVE-2026-20079 and the paired flaw, then hunt for credential theft and Qilin indicators on any FMC exposed since disclosure.
  • Update PaperCut NG/MF to 26.0.5, 25.0.13, or 24.1.10 (the emergency patches are superseded) and check server logs for unexpected admin activity.
  • Pull FMC and PaperCut web interfaces off the public internet or put them behind VPN/allowlist. There is no reason these should be reachable.
  • Assume compromise on any of these that sat unpatched: rotate device and service credentials, review admin accounts for additions.
  • Cross-check your exposure against Wiz’s JFrog Artifactory chain and the Cisco/PaperCut IOCs while you are in there.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patched last week is not patched today if you never installed it.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.