Attackers who compromised Cisco Secure Firewall Management Center appliances moved beyond the firewall-management console into the networks those systems oversee. Cisco Talos disclosed three intrusion clusters on September 9: one stole user credentials, one installed the Cyclops Blink implant, and one built an endpoint target list before deploying Qilin ransomware on selected systems.
The activity affects organizations running unpatched on-premises Secure FMC. Attackers used the critical authentication bypass CVE-2026-20079, the static-credential flaw CVE-2026-20316, or both. Cisco now says it observed exploitation of CVE-2026-20079 in August; its March advisory had previously described the root-access path without reporting malicious use.
Root access became network access
CVE-2026-20079 lets an unauthenticated remote attacker send crafted HTTP requests to the FMC web interface, bypass authentication, and execute scripts or commands as root. Cisco rates the flaw critical at CVSS 10.0. An FMC management interface without public internet access has a smaller attack surface, but Cisco says the affected on-premises software remains vulnerable regardless of device configuration.
The second flaw, CVE-2026-20316, exposes a static low-privilege account. Talos observed operators combining that access with the legitimate /usr/local/sf/bin/package_info.pl utility and an attacker-crafted /var/tmp/license.tmp package. The utility’s installation path executes the package as root, converting limited appliance access into command execution.
Talos states the operational consequence plainly: “Talos’ analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors.” The report names the clusters UAT-12197, UAT-11823, and UAT-11988; those tracking labels separate observed activity and do not identify all operators behind it.
Three clusters took different paths
UAT-12197 exploited CVE-2026-20079 and placed a JSP web shell in the CSM Tomcat webroot. The shell decoded the parameter F6C1F0E7 and loaded a supplied Java class. Attackers then placed cmd.jar, a command executor that passed its command to /bin/sh -c, and queried the FMC internal database for usernames and authentication data.
Talos attributes UAT-11823 with high confidence to an advanced persistent threat actor whose tooling overlaps Sandworm. The actor exploited CVE-2026-20079, used static credentials, or used both paths. It replaced license.tmp with a malicious Makeself package, created a Netcat reverse shell through /tmp/f, collected managed-device configurations, and staged them in archives for exfiltration. The actor also downloaded Cyclops Blink, a modular implant with persistence, DNS-over-HTTPS resolution, file transfer, credential harvesting, command execution, network discovery, and packet-sniffing capabilities.
The third cluster, UAT-11988, began with the static credential and abused built-in FMC tooling to enumerate the environment. The operator collected hostnames, addresses, directory listings, Active Directory service-account credentials, MySQL credentials, domain accounts, and computer objects. It then staged a Python SOCKS5 proxy named socks5.py and a reverse SSH tunnel that forwarded LDAP on 389, LDAPS on 636, Kerberos on 88, SMB on 445, NetBIOS on 135, and WinRM on 5985.
After probing endpoints, the operator deployed Impacket, Invoke-TheHash, custom antivirus killers, and Qilin ransomware on selected systems. Talos assesses with high confidence that UAT-11988 is a ransomware operator and says its later actions were consistent with Qilin affiliates. The public evidence does not identify a named affiliate or show that Qilin controlled the other two clusters.
Figure details
The figure begins with an on-premises Cisco Secure FMC appliance. One initial-access path uses CVE-2026-20079 to bypass authentication and obtain root command execution; another uses the CVE-2026-20316 static credential and then abuses package_info.pl with an attacker-crafted license.tmp package. The paths lead to three separate Talos clusters. UAT-12197 deploys a JSP web shell and cmd.jar to query credentials. UAT-11823 establishes a Netcat reverse shell, exfiltrates device configurations, and deploys Cyclops Blink. UAT-11988 inventories the organization, creates SOCKS and reverse-SSH tunnels, harvests credentials, targets endpoints, and deploys Qilin ransomware on selected systems. The branches remain separate because Talos did not observe every technique in every intrusion.
Published artifacts support recognition
Cisco’s appliance-level check searches log files for package_info execution involving a license file:
zgrep "package_info.*license" messages*The advisory’s example shows sudo running /usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm as root. Cisco warns that the hot fixes prevent future exploitation and may not address an existing compromise. A match therefore calls for evidence preservation and Cisco TAC-assisted recovery, not only patch installation.
Talos published two SHA-256 values: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d for the home.jsp web shell, and db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e for cmd.jar. The Cyclops Blink sample is 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461.
The network indicators are 89[.]34[.]96[.]56, used for Netcat and Cyclops Blink command and control; 208[.]123[.]119[.]215 and 91[.]214[.]78[.]118, used for Netcat command and control; 104[.]218[.]165[.]253, used to scan for CVE-2026-20079; and 43[.]204[.]2[.]142, used in UAT-11988 intrusions. Talos lists Snort SIDs 66075-66080 for CVE-2026-20079, Snort SID 66883 for CVE-2026-20316, and Snort SIDs 66960, 66961 for the malware.
These values support recognition across FMC logs, network telemetry, endpoint records, and retained files. Their absence does not clear an appliance: Cisco and Talos describe three different clusters, and neither source claims the published list covers every intrusion.
Hot fixes stop future entry
Cisco lists hot fixes for each supported FMC train: Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar for 7.0, Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar for 7.2, Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar for 7.4, Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar for 7.6, Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar for 7.7, and Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar for 10.0.
No workaround fixes CVE-2026-20079. Cisco recommends the listed hot fix or a fixed software release and provides its Software Checker for release-specific exposure. Security Cloud Control Firewall Management was also affected, but Cisco deployed the fix to that SaaS environment and says customers need take no action for the service. Firewall Device Manager, ASA, FTD, and the separate Security Cloud Control product formerly called Defense Orchestrator are outside this advisory’s affected list.
CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog on September 9 and set a September 12 federal remediation deadline. The catalog requires applicable forensic triage under BOD 26-04. Cisco and Talos do not quantify affected organizations, appliances, or encrypted endpoints, and the public record does not establish whether every compromised FMC was directly internet-accessible.
Test the running appliance
Identify every on-premises FMC and compare its running release and installed hot fix with Cisco’s current table. Reduce management-interface reach to approved networks while remediation is staged. After installation and restart, query the running appliance again; the expected result is the correct hot-fix package or a fixed release on every managed instance, not merely a successful deployment record.
Preserve /var/log/messages, authentication history, package_info.pl execution, webroot files, network flows, managed-device configuration access, and downstream endpoint activity across the exposure window. Search for every published hash, address, port, Snort SID, path, filename, and parameter before retention or cleanup changes the evidence. A license.tmp match or any cluster indicator warrants Cisco TAC involvement and investigation of credentials, tunnels, exfiltration, and managed endpoints.
The appliance patch closes the published entry paths. Organizations still need to determine how far attackers carried FMC authority into credentials, network tunnels, managed devices, and endpoints before remediation.