Cisco Talos warns that threat actors are actively exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software, including a critical authentication-bypass flaw that can give unauthenticated remote attackers root-level access to affected appliances.
The most severe issue, CVE-2026-20079, carries a CVSS score of 10.0. It lets attackers bypass authentication on unpatched Cisco Secure FMC instances and run scripts that ultimately grant root access to the underlying operating system.
A second flaw, CVE-2026-20316, has a CVSS score of 5.3 and permits remote login through a low-privileged static account.
Hackers Exploit Critical Cisco FMC Flaws
While the latter vulnerability is rated moderate, Talos said attackers are chaining it with other FMC flaws to escalate privileges, execute malicious packages, and expand access into victim networks.
Talos identified three separate clusters of post-compromise activity involving state-linked and financially motivated attackers.
The first cluster, tracked as UAT-12197, exploited CVE-2026-20079 to deploy a JSP-based web shell in the CSM Tomcat webroot directory. The web shell Base64-decodes a parameter named “F6C1F0E7” and loads a Java class in the FMC Java process.
Attackers subsequently placed a malicious cmd.jar file on the system. The JAR acts as a command executor, passing attacker-supplied commands to /bin/sh -c.
Talos observed it being used to run OmniQuery.pl against FMC’s internal database and retrieve user names and authentication data from the users table.
A second campaign, UAT-11823, was attributed with high confidence to an advanced persistent threat actor whose tooling overlaps with the Russian Sandworm group.
The attackers gained initial access by exploiting CVE-2026-20079 or using the static credentials exposed through CVE-2026-20316.
They replaced the license.tmp file with a malicious Makeself package that created a Netcat-based reverse shell to a command-and-control server.
Cisco’s legitimate package_info.pl utility then executed the attacker-controlled package as root, turning a built-in administration component into a privilege-escalation mechanism.
The actor also deployed Bash scripts to collect managed-device configurations and archive them for exfiltration. More significantly, Talos observed the deployment of a modular ELF variant of Cyclops Blink, malware previously associated with Sandworm.
The implant supports persistence through /etc/init.d/, DNS-over-HTTPS resolution, file transfers, credential theft, command execution, network discovery, packet sniffing, and scanning.
A third cluster, UAT-11988, was linked with high confidence to a ransomware operator whose activity aligned with Qilin affiliate tradecraft.
The group used CVE-2026-20316 to access FMC appliances, then abused package_info.pl and a weaponized license.tmp file to conduct reconnaissance with root privileges.
The operators collected hostnames, IP addresses, Active Directory and MySQL credentials, domain-account data, computer inventories, and mappings for domain controllers, ADFS servers, Exchange servers, file servers, and databases.
To maintain access, the group deployed a Python SOCKS5 proxy and reverse SSH tunnels exposing LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM services.
It then used Impacket, Invoke-TheHash, custom antivirus-killing tools, and ultimately deployed Qilin ransomware on selected endpoints.
Mitigation
Cisco has released hotfixes for both vulnerabilities and plans a broader hardening release during the week of September 14.
Organizations should apply the available fixes immediately, review FMC appliances for unauthorized license.tmp, web shell, JAR, proxy, and tunnel artifacts, and investigate possible credential exposure.
Defenders can also use Snort SIDs 66075–66080 for CVE-2026-20079, SID 66883 for CVE-2026-20316, and SIDs 66960–66961 to detect associated malware.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 Software, including a critical authentication-bypass flaw that can give unauthenticated remote attackers root-level access to affected appliances.){kind=link}