Cisco FMC Zero-Auth Flaws Exploited by Qilin Ransomware and Sandworm-Linked Hackers

Cisco Secure Firewall Management Center vulnerabilities are being actively exploited by three threat clusters conducting ransomware deployment, credential theft, espionage, and persistent network access.

The attacks target CVE-2026-20079, a critical authentication bypass enabling root-level command execution, and CVE-2026-20316, which exposes static credentials for a low-privileged account. Cisco has released hot fixes and is urging customers to install them immediately.

Cisco Talos tracks the groups as UAT-12197, UAT-11823, and UAT-11988. Their activity demonstrates how compromising a centralized firewall-management system can expose credentials, device configurations, internal services, and endpoints behind the security perimeter.

Two FMC weaknesses provide different routes into the appliance

CVE-2026-20079 affects the web interface of Cisco Secure Firewall Management Center 7.0.0. It carries the maximum CVSS v3 score of 10.0, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

The vulnerability is categorized as CWE-288, an authentication bypass through an alternate path or channel. An improperly created system process during boot allows an unauthenticated remote attacker to send crafted HTTP requests, execute script files, and potentially gain root access to the underlying operating system.

No user interaction or prior account is required. That makes an internet-exposed management interface an especially dangerous target.

CVE-2026-20316 affects Cisco Secure Firewall Management Center versions up to and including 7.0.9. It has a CVSS v3 score of 5.3 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

This second flaw, categorized as CWE-259, results from static credentials embedded for a low-privileged account. An unauthenticated attacker can use those credentials to access information available to that account.

The lower score does not reflect the full operational risk. Cisco rates the issue High because attackers can combine the initial access with other FMC weaknesses to escalate privileges and move deeper into the managed environment.

Cisco has provided hot fixes for both vulnerabilities. The exact fixed build numbers have not been disclosed in the available information, while a broader FMC hardening release addressing additional vulnerabilities is expected next week.

Qilin operators turned static credentials into ransomware access

Talos attributes UAT-11988 with high confidence to affiliates of the Qilin ransomware operation. The attackers initially accessed an FMC appliance with the static credentials associated with CVE-2026-20316.

After logging in, they used legitimate FMC capabilities to map the victim’s environment. Their collection included hostnames, IP addresses, directory listings, computer inventories, domain information, and mappings between internal servers and their addresses.

The operators also obtained Active Directory service-account credentials, MySQL credentials, and other domain-account data. They staged the stolen information in files exposed through the compromised FMC server, then downloaded those files with HTTP GET requests.

To reach systems beyond the appliance, the attackers established a Python SOCKS5 proxy and a reverse SSH tunnel. Port forwarding gave them paths to LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM services inside the network.

Their toolkit included Impacket, Invoke-TheHash, and custom utilities intended to terminate or disable endpoint detection and response software. The operation concluded with Qilin ransomware being deployed to endpoints and encrypting files.

The sequence shows that low-privileged FMC access can become a bridge into identity infrastructure and Windows administration services when left uncontained.

Sandworm-linked cluster deployed a Cyclops Blink variant

Talos associates UAT-11823 with an advanced persistent threat actor whose tooling overlaps with Sandworm, the Russian state-sponsored group linked to the GRU. The cluster used both FMC vulnerabilities during observed intrusions.

The operators gained access either through the CVE-2026-20079 authentication bypass or the static credentials exposed by CVE-2026-20316. They then altered a file named license.tmp to establish a Netcat reverse shell connected to command-and-control infrastructure.

A legitimate Cisco utility, package_info.pl, was used to execute the malicious license file with root privileges. This technique blended attacker-controlled content with a trusted administrative component already present on the appliance.

The group also ran scripts that collected configuration data from devices managed by FMC. That material was compressed into archives in preparation for exfiltration.

Its final payload was a Cyclops Blink variant. The modular Linux malware provided persistent access, captured credentials, and sniffed network traffic.

This activity also resolves an earlier uncertainty surrounding the two flaws. Cisco disclosed exploitation of CVE-2026-20316 on July 29, 2026, and included /var/tmp/license.tmp as an indicator. The company later placed the same indicator in information about CVE-2026-20079 without confirming a connection.

Talos has now linked the mechanism to UAT-11823 and confirmed that the cluster exploited both vulnerabilities.

A third cluster installed a Java command backdoor

UAT-12197 followed a different post-exploitation path after abusing CVE-2026-20079. The attackers placed a JSP web shell in the Cisco Security Manager Tomcat webroot directory.

That web shell installed a malicious Java archive named cmd.jar, which enabled command execution on the compromised server. The operators subsequently queried internal databases and collected user authentication records and credentials.

Although no ransomware or state affiliation has been disclosed for UAT-12197, its activity produced the same core consequence: the firewall-management appliance became a platform for accessing data beyond its intended administrative role.

CISA deadlines reflect confirmed exploitation

CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog on July 29, 2026. The remediation deadline for US federal agencies was August 1, 2026.

CVE-2026-20079 entered the KEV catalog on September 9, 2026, with a federal remediation deadline of September 12, 2026. Its inclusion confirms that the issue is not merely theoretical.

For both flaws, CISA requires mitigations aligned with Cisco’s instructions, BOD 26-04, and the agency’s Forensics Triage Requirements. Applicable cloud-service guidance must also be followed. Where mitigations are unavailable, CISA directs affected organizations to discontinue use of the product.

The entries join several other Cisco vulnerabilities added to KEV during the last 90 days: CVE-2026-20349 on August 11, 2026; CVE-2008-4128 on July 13, 2026; CVE-2026-20230 on June 25, 2026; and CVE-2026-20262 on June 15, 2026.

Patching must be accompanied by compromise assessment

Administrators should install Cisco’s hot fixes for both vulnerabilities immediately and prepare to evaluate the broader hardening release expected next week. Systems should be checked specifically for FMC 7.0.0 exposure to CVE-2026-20079 and versions through 7.0.9 for CVE-2026-20316.

Patching alone cannot remove artifacts or credentials left behind by an earlier intrusion. Security teams should investigate for:

• /var/tmp/license.tmp or other modified license.tmp files
• Unusual execution of package_info.pl
• Netcat reverse shells, Python SOCKS5 proxies, and reverse SSH tunnels
• JSP web shells in Tomcat webroot directories
• The malicious archive cmd.jar
• Publicly accessible files containing staged reconnaissance data
• HTTP GET requests used to retrieve those files
• Impacket, Invoke-TheHash, or tools that disable EDR products
• Unexpected forwarding of LDAP, LDAPS, Kerberos, SMB, NetBIOS, or WinRM traffic
• Cyclops Blink components or Qilin ransomware activity

Organizations should also review FMC administrative actions, managed-device configuration exports, database queries, and access to internal identity services.

Potentially exposed Active Directory, domain, service-account, MySQL, and FMC credentials should be rotated. Investigators should assume that credentials stored on or reachable from a compromised management appliance may have been collected, even if ransomware was not observed.

If a vulnerable FMC instance cannot be mitigated, CISA’s direction is to discontinue its use rather than leave an exploitable management plane in operation.