Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
Cisco Talos warns of active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center allowing unauthenticated root-level code execution, and CVE-2026-20316 (CVSS 5.3), which permits login via a low-privileged static account for privilege escalation. Hotfixes are available now, with a broader hardening release planned for the week of September 14. Three post-compromise activity clusters were identified: UAT-12197 deployed a home.jsp web shell and cmd.jar command executor; UAT-11823, attributed with high confidence to a Sandworm-linked APT, deployed a Netcat reverse shell and Cyclops Blink; and UAT-11988 showed Qilin ransomware tactics including Active Directory enumeration and credential theft before deploying Qilin ransomware.
- CVE-2026-20079 (CVSS 10.0) enables unauthenticated auth bypass and root code execution on FMC
- CVE-2026-20316 allows remote login with a static low-privileged account for privilege escalation
- UAT-12197 dropped home.jsp web shell and cmd.jar to extract credentials via OmniQuery.pl
- UAT-11823, tied to Sandworm's tooling, deployed Cyclops Blink with init.d persistence and DoH
- UAT-11988 used Qilin affiliate tactics: AD enumeration, credential theft, and ransomware deployment
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1078.001 Default AccountsT1059.004 Unix ShellT1486 Data Encrypted for Impact
- Tags
- authentication-bypassciscocyclops-blinkqilinransomwaresandwormsecure-firewall-management-centerweb-shell
- Vendors
- Cisco
- Organizations
- Cisco Talos
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.218.165.253 | link C2 208.123.119[.]215 UAT-11823 Netcat reverse-shell C2 104.218.165[.]253 UAT-11823 Scanner targeting CVE-2026-20079 91.214.78[.]11 |
| ipv4 | 208.123.119.215 | 96[.]56 UAT-11823 Netcat reverse-shell and Cyclops Blink C2 208.123.119[.]215 UAT-11823 Netcat reverse-shell C2 104.218.165[.]253 UAT-1 |
| ipv4 | 43.204.2.142 | 881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink ELF malware 43.204.2[.]142 UAT-11988 Intrusion source IP associated with Qilin-linke |
| ipv4 | 89.34.96.56 | b7d8cc7a1a8c8e UAT-12197 cmd.jar JAR-based command executor 89.34.96[.]56 UAT-11823 Netcat reverse-shell and Cyclops Blink C2 208.1 |
| ipv4 | 91.214.78.118 | 04.218.165[.]253 UAT-11823 Scanner targeting CVE-2026-20079 91.214.78[.]118 UAT-11823 Netcat reverse-shell C2 6f98add5d1a7729192b6ad8 |
| sha256 | 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 | 026-20079 91.214.78[.]118 UAT-11823 Netcat reverse-shell C2 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 UAT-11823 Cyclops Blink ELF malware 43.204.2[.]142 UAT-1198 |
| sha256 | b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d | as MISP, VirusTotal, or your SIEM. IOC Cluster Description b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f |
| sha256 | db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e | fd0fdfd07162cb4eb2acbef77d UAT-12197 home.jsp JSP web shell db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e UAT-12197 cmd.jar JAR-based command executor 89.34.96[.]56 |
From the original article
3 min read at gbhackers.com
Cisco Talos has warned that threat actors are actively exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software. These vulnerabilities can lead to unauthorized access, root-level code execution, credential theft, network reconnaissance, and malware deployment.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.