Security Bulletin

Cisco Firewall Zero-Day Exploitation in Ransomware Campaigns

Date: March 2026
Severity: Critical
Threat Type: Initial Access / Infrastructure Compromise

Executive Summary

A recently disclosed set of Cisco firewall and management interface vulnerabilities are now being actively exploited in the wild, including in ransomware campaigns associated with the Interlock group.

These vulnerabilities allow unauthenticated attackers to gain control of firewall infrastructure, effectively bypassing traditional security controls and gaining direct access into internal networks.

This represents a significant shift in attacker behavior, targeting core network infrastructure rather than endpoints or users.

What’s Going On

Cisco has disclosed multiple critical vulnerabilities affecting firewall management platforms, including Cisco Secure Firewall Management Center (FMC).

These vulnerabilities enable attackers to:

• Execute arbitrary code remotely

• Bypass authentication mechanisms

• Obtain root-level access to affected systems

In some observed cases, exploitation can occur through crafted HTTP requests sent directly to exposed management interfaces.

This means an externally accessible firewall management interface can be compromised without valid credentials.

Why This Matters

Firewalls serve as the primary control point between internal networks and external threats. When compromised, they provide attackers with:

• Trusted access into the internal network

• The ability to manipulate or disable logging and detection

• A platform for lateral movement that may appear legitimate

This follows a broader trend of attackers targeting high-value infrastructure, including:

• Email security gateways

• VPN appliances

• Edge network devices

Systems that operate at the boundary of the network and maintain elevated privileges are increasingly becoming the preferred entry point.

Threat Activity: Interlock Ransomware

The Interlock ransomware group has been linked to campaigns leveraging these types of vulnerabilities for initial access.

Unlike traditional intrusion methods such as phishing or endpoint compromise, this approach targets infrastructure directly.

This allows attackers to bypass user interaction entirely and establish a foothold before traditional detection mechanisms are triggered.

Defender Considerations

Compromise at the firewall or management layer introduces several challenges:

• Initial access occurs at the network control plane

• Logging and telemetry may be altered or suppressed

• Malicious activity may appear as trusted internal traffic

• Detection may only occur after lateral movement has begun

Organizations should assume reduced visibility in early stages of compromise.

Recommended Actions

1. Immediate Patching

All affected Cisco firewall and FMC systems should be identified and patched without delay.

2. Restrict Management Access

• Remove public internet exposure of management interfaces

• Limit access to trusted IP ranges only

• Require VPN or jump host access for administrative functions

3. Assume Potential Exposure

Organizations should evaluate whether exploitation may have already occurred.

Key indicators to review include:

• Unauthorized configuration changes

• Creation of new or unexpected administrative accounts

• Outbound connections originating from firewall devices

• Gaps or inconsistencies in logging data

4. Proactive Threat Hunting

Organizations should actively review:

• Firewall and management interface logs

• Network telemetry including NetFlow and Zeek data

• Authentication activity across administrative systems

• Configuration changes and policy modifications

This should be treated as an active investigation rather than passive monitoring.

5. Validate Visibility and Detection

Organizations should assess whether they retain visibility in the event of firewall compromise.

If logging, telemetry, or detection depends solely on the affected device, additional controls are required.

Strategic Considerations

This activity reflects a broader evolution in attacker strategy:

• Increased focus on infrastructure-level compromise

• Exploitation of pre-authentication vulnerabilities

• Targeting of control plane systems rather than endpoints

The traditional model of trusting network infrastructure while focusing on endpoint security is no longer sufficient.

Conclusion

The most impactful vulnerabilities are not always those with the highest severity scores, but those that undermine core security assumptions.

In this case, the assumption that the firewall is a trusted control point is being directly challenged.

Organizations should treat this as a priority event and respond accordingly.