Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware

Cisco Talos has confirmed active exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC) Software, with state-sponsored hacking groups and a ransomware affiliate leveraging the flaws to seize root access, plant malware, and stage attacks on enterprise networks.

The disclosure marks one of the year’s more serious enterprise security incidents, given FMC’s role as the central console administrators use to manage fleets of Cisco firewalls.

Hackers Exploit Cisco Firewall Flaw

The more dangerous of the two bugs, tracked as CVE-2026-20079, carries a perfect CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass login controls entirely.

The flaw stems from an improper system process created when an FMC device boots up; if the resulting session is never claimed by a legitimate user, an attacker can hijack it and use it to execute scripts with root privileges over the underlying operating system.

Cisco patched the issue in March 2026, but confirmed on September 9 that its Product Security Incident Response Team became aware of in-the-wild abuse beginning in August.

The U.S. Cybersecurity and Infrastructure Security Agency has since added the vulnerability to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 12 to remediate.

The second flaw, CVE-2026-20316, rates a comparatively modest 5.3 on the CVSS scale but stems from hard-coded, static credentials tied to a low-privileged account that let remote attackers log in without proper authorization.

On its own, the bug offers limited access, but Talos warns it becomes far more dangerous when chained with the authentication bypass or other FMC vulnerabilities to escalate privileges. Cisco disclosed and patched this issue in late July 2026, and CISA added it to the KEV catalog around the same time.

Talos researchers identified three separate clusters of post-compromise activity, each reflecting a different threat actor’s objectives, as detailed in Cisco Talos’s technical disclosure.

The first, designated UAT-12197, exploited the authentication bypass to plant a JSP-based web shell inside the FMC’s Tomcat webroot directory, then used it to drop a Java Archive command executor named “cmd.jar” capable of querying the device’s internal database to steal stored user credentials.

The second cluster, UAT-11823, is assessed with high confidence to be an advanced persistent threat actor overlapping with the Russian military-linked group Sandworm.

This group chained both CVEs, replaced a legitimate license file with a malicious Makeself package to establish a Netcat-based reverse shell, exfiltrated device configurations, and ultimately deployed a variant of the Cyclops Blink malware, a modular implant previously tied to Sandworm’s botnet operations against network edge devices.

The Cyclops Blink variant found on compromised FMC systems supports persistence via init.d scripts, DNS-over-HTTPS command-and-control resolution, credential harvesting, packet sniffing, and arbitrary remote command execution.

The third cluster, UAT-11988, is assessed with high confidence to be a Qilin ransomware operator that skipped the authentication bypass entirely, instead logging in through the static-credential flaw before living off the land using FMC’s own built-in administrative tooling.

The group harvested Active Directory and MySQL credentials, mapped domain controllers, file servers, and Exchange infrastructure, then tunneled deeper into victim networks over LDAP, Kerberos, SMB, NetBIOS, and WinRM using a Python SOCKS5 proxy and reverse-SSH connections before deploying antivirus killers and the Qilin ransomware payload on selected endpoints.

Cisco and Talos are urging every organization running Secure FMC to apply the already-released hotfixes for both CVE-2026-20079 and CVE-2026-20316 immediately rather than waiting for a broader hardening release scheduled for the week of September 14, which will bundle these fixes with additional internally discovered patches.

Administrators who cannot patch immediately should also restrict FMC management interfaces from internet exposure, since this significantly reduces the attack surface for all three observed campaigns.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.