Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware

Cisco Talos has warned that threat actors are actively exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software. These vulnerabilities can lead to unauthorized access, root-level code execution, credential theft, network reconnaissance, and malware deployment.

Critical Cisco FMC Flaws

The most critical issue is identified as CVE-2026-20079, a critical authentication-bypass vulnerability with a CVSS score of 10.0.

This vulnerability allows an unauthenticated remote attacker to bypass FMC authentication controls and execute scripts on compromised systems, potentially gaining root access to the underlying operating system.

The second vulnerability, CVE-2026-20316 (CVSS 5.3), permits remote login using a low-privileged static account and can be combined with other FMC vulnerabilities to escalate privileges.

Talos has identified three distinct clusters of post-compromise activities linked to state-sponsored and financially motivated actors. Cisco has released hotfixes for both vulnerabilities and urged affected organizations to deploy them immediately, ahead of a broader hardening release planned for the week of September 14.

The first activity cluster, tracked as UAT-12197, exploited CVE-2026-20079 to deploy a JSP web shell named home.jsp in the Cisco Security Manager Tomcat webroot. This web shell Base64-decodes a parameter called F6C1F0E7 to load a Java class.

Attackers then placed cmd.jar, a Java Archive-based command executor, on the appliance, which accepts commands as arguments and executes them through `/bin/sh -c`. Talos observed this being used with the FMC OmniQuery.pl utility to query the internal database and extract usernames and authentication data from the users table.

A second cluster, UAT-11823, has been attributed with high confidence to an advanced persistent threat actor whose tools overlap with Sandworm’s.

This group exploited CVE-2026-20079 and CVE-2026-20316, replacing license.tmp with a malicious Makeself package. This package was executed as root through the legitimate package_info.pl utility, creating a Netcat-based reverse shell. The attackers harvested managed-device configurations, staged them in archives, and deployed a modular ELF variant of Cyclops Blink.

The implant supports persistence through `/etc/init.d/`, DNS-over-HTTPS IP resolution, file transfers, credential harvesting, arbitrary command execution, network discovery, and packet sniffing. Cyclops Blink has previously been publicly linked to the Russian Sandworm threat group.

Talos has also linked UAT-11988 to a ransomware operation demonstrating tactics consistent with Qilin affiliates. The actor used static credentials from CVE-2026-20316 to access FMC systems, then abused package_info.pl to run a malicious license.tmp file as root.

The activities included Active Directory enumeration, credential theft, MySQL account collection, hostname and IP discovery, endpoint targeting, and HTTP-based exfiltration. The attackers later deployed SOCKS5 proxy tools, reverse SSH tunnels, Impacket, Invoke-The-Hash, custom anti-virus evasion utilities, and Qilin ransomware.

Organizations are advised to apply Cisco’s available hotfixes, investigate FMC systems for the listed indicators, and monitor for suspicious use of package_info.pl, unexpected files in Tomcat directories, outbound reverse-shell traffic, and new persistence scripts located in `/etc/init.d/`.

Ioc

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

IOC	Cluster	Description
b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d	UAT-12197	home.jsp JSP web shell
db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e	UAT-12197	cmd.jar JAR-based command executor
89.34.96[.]56	UAT-11823	Netcat reverse-shell and Cyclops Blink C2
208.123.119[.]215	UAT-11823	Netcat reverse-shell C2
104.218.165[.]253	UAT-11823	Scanner targeting CVE-2026-20079
91.214.78[.]118	UAT-11823	Netcat reverse-shell C2
6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461	UAT-11823	Cyclops Blink ELF malware
43.204.2[.]142	UAT-11988	Intrusion source IP associated with Qilin-linked activity

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.