Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware

Cisco Talos has warned that threat actors are actively exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software. These vulnerabilities can lead to unauthorized access, root-level code execution, credential theft, network reconnaissance, and malware deployment.

Critical Cisco FMC Flaws

The most critical issue is identified as CVE-2026-20079, a critical authentication-bypass vulnerability with a CVSS score of 10.0.

This vulnerability allows an unauthenticated remote attacker to bypass FMC authentication controls and execute scripts on compromised systems, potentially gaining root access to the underlying operating system.

The second vulnerability, CVE-2026-20316 (CVSS 5.3), permits remote login using a low-privileged static account and can be combined with other FMC vulnerabilities to escalate privileges.

Talos has identified three distinct clusters of post-compromise activities linked to state-sponsored and financially motivated actors. Cisco has released hotfixes for both vulnerabilities and urged affected organizations to deploy them immediately, ahead of a broader hardening release planned for the week of September 14.

The first activity cluster, tracked as UAT-12197, exploited CVE-2026-20079 to deploy a JSP web shell named home.jsp in the Cisco Security Manager Tomcat webroot. This web shell Base64-decodes a parameter called F6C1F0E7 to load a Java class.

Attackers then placed cmd.jar, a Java Archive-based command executor, on the appliance, which accepts commands as arguments and executes them through `/bin/sh -c`. Talos observed this being used with the FMC OmniQuery.pl utility to query the internal database and extract usernames and authentication data from the users table.

A second cluster, UAT-11823, has been attributed with high confidence to an advanced persistent threat actor whose tools overlap with Sandworm’s.

This group exploited CVE-2026-20079 and CVE-2026-20316, replacing license.tmp with a malicious Makeself package. This package was executed as root through the legitimate package_info.pl utility, creating a Netcat-based reverse shell. The attackers harvested managed-device configurations, staged them in archives, and deployed a modular ELF variant of Cyclops Blink.

The implant supports persistence through `/etc/init.d/`, DNS-over-HTTPS IP resolution, file transfers, credential harvesting, arbitrary command execution, network discovery, and packet sniffing. Cyclops Blink has previously been publicly linked to the Russian Sandworm threat group.

Talos has also linked UAT-11988 to a ransomware operation demonstrating tactics consistent with Qilin affiliates. The actor used static credentials from CVE-2026-20316 to access FMC systems, then abused package_info.pl to run a malicious license.tmp file as root.

The activities included Active Directory enumeration, credential theft, MySQL account collection, hostname and IP discovery, endpoint targeting, and HTTP-based exfiltration. The attackers later deployed SOCKS5 proxy tools, reverse SSH tunnels, Impacket, Invoke-The-Hash, custom anti-virus evasion utilities, and Qilin ransomware.

Organizations are advised to apply Cisco’s available hotfixes, investigate FMC systems for the listed indicators, and monitor for suspicious use of package_info.pl, unexpected files in Tomcat directories, outbound reverse-shell traffic, and new persistence scripts located in `/etc/init.d/`.

Ioc

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.