Cisco FMC Flaws CVE-2026-20079 and CVE-2026-20316 Exploited by Ransomware, State Hackers

Cisco Talos is tracking three separate intrusion clusters that abused two vulnerabilities in Cisco's Secure Firewall Management Center (FMC) software. Per Talos's September 9, 2026 advisory, CVE-2026-20079 is a maximum-severity authentication bypass that lets an unauthenticated remote attacker execute scripts as root on unpatched FMC instances. CVE-2026-20316 lets a remote attacker log in using a static, low-privileged account credential.

CVE-2026-20079 carries a CVSS score of 10.0. CVE-2026-20316 scores 5.3, but Cisco rates it High severity because attackers can chain it with other FMC flaws to escalate privileges. Cisco has already released hotfixes for both bugs and, per its advisories, plans a broader hardening release covering additional internally found vulnerabilities the week of September 14, 2026.

FMC is the central console that manages an organization's fleet of Cisco Secure Firewall appliances. An attacker who gains root on FMC can see and touch the configuration of every firewall it manages, making it a high-value target rather than a single point of failure.

The three clusters Talos describes show that a Russia-linked APT and a ransomware affiliate found and weaponized the same two bugs independently, within weeks of Cisco's July disclosure. That pattern, an internet-facing management appliance exploited by unrelated actors for different goals (espionage and extortion), is now a routine part of how quickly perimeter security software gets targeted once a serious flaw becomes public.

The first cluster, tracked by Talos as UAT-12197, exploited CVE-2026-20079 to drop a JSP-based web shell into the Cisco Security Manager Tomcat webroot directory. The web shell then installed a JAR file named cmd.jar that worked as a command executor.

/var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e \'SELECT name, auth_data FROM users;\''

The attackers used that JAR file to query FMC's internal database directly and pull user authentication data and credentials, according to Talos's technical writeup.

Talos attributes the second cluster, UAT-11823, with high confidence to an advanced persistent threat whose tooling overlaps with Sandworm, the Russian GRU-linked group. The actor got in by exploiting either CVE-2026-20079 or the static credentials tied to CVE-2026-20316, then modified a legitimate license.tmp file on disk and had it executed as root through Cisco's own package_info.pl utility, opening a Netcat-based reverse shell to its command-and-control server.

Talos assesses with high confidence that UAT-11823 exploited both CVEs during the intrusion. The final payload was a variant of Cyclops Blink, a modular Linux backdoor previously linked to Sandworm by US and UK authorities, giving the operator persistent access, credential theft, and network traffic sniffing on compromised devices.

The third cluster, UAT-11988, which Talos assesses with high confidence is a Qilin ransomware affiliate, logged into an FMC device using CVE-2026-20316's static credentials. The operator then abused legitimate, built-in FMC tools to map the victim's network: hostnames, IP addresses, Active Directory service-account credentials, MySQL credentials, and domain account data.

• Staged stolen data in publicly accessible files on the FMC server and exfiltrated it over HTTP GET requests
• Set up a Python SOCKS5 proxy and a reverse SSH tunnel, forwarding LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM
• Ran post-exploitation tools including Impacket, Invoke-TheHash, and custom EDR killers before deploying Qilin ransomware on selected endpoints

Cisco published hotfixes for CVE-2026-20079 and CVE-2026-20316 shortly after the July disclosure and is shipping a wider hardening release the week of September 14, 2026 that folds in other internally discovered issues. Talos also published Snort signature IDs and indicators of compromise on its GitHub repository.

1. Apply Cisco's hotfixes for both CVEs now rather than waiting for the hardening release
2. Check for unexpected modifications to license.tmp and unfamiliar JAR files under the Tomcat webroot
3. Rotate any credentials that may have been exposed through FMC, including AD service accounts and MySQL accounts
4. Compare outbound connections and DNS activity against the IPs and hashes Talos published for UAT-12197, UAT-11823, and UAT-11988

Cisco first disclosed CVE-2026-20316 as actively exploited on July 29, 2026, and separately updated its CVE-2026-20079 advisory with the same license.tmp indicator of compromise, without confirming at the time that the two flaws were linked. Talos's report now closes that gap: it confirms UAT-11823 chained both CVEs using the license.tmp mechanism.

The open question going forward is whether other actors follow once exploitation details and IOCs are public, and how effective Cisco's September 14 hardening release is at closing off the additional internally discovered issues it will patch.