Cisco FMC CVE-2026-20079: Sandworm-linked and Qilin clusters hit firewall management for root

Update, Sep 16: Cisco says the hotfixes stop new exploitation but may not clean a device that is already compromised, so contact Cisco TAC if you find IoCs. To check an FMC, run zgrep "package_info.*license" /var/log/messages* in expert mode; hits that reference /var/tmp/license.tmp may indicate exploitation. Per Cisco, FDM, ASA and FTD software are not affected, and Cisco has already patched the cloud-hosted Security Cloud Control Firewall Management.

What Changed

Cisco Talos confirmed on September 9–10 that three intrusion clusters are actively abusing Cisco Secure Firewall Management Center (FMC) web-interface flaws. The lead bug gives root on the underlying OS. CVE-2026-20079 is an authentication bypass caused by an improper system process created at boot time. An unauthenticated remote attacker who can reach the FMC web interface sends crafted HTTP requests and can execute scripts and commands that grant root on the device. Cisco discovered it internally, disclosed and fixed it in early March 2026 (advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2), and on September 9 stated it became aware of active exploitation dating to August. CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog the same day with a three-day BOD 26-04 window and forensic-triage requirements.

CVE-2026-20316 is related in-the-wild context only: static credentials for a low-privileged built-in account, disclosed with fixes around July 29 and previously flagged for exploitation. It is not the lead CVE for this brief, but Talos’s clusters use one or both bugs depending on the actor.

Talos cluster names, as reported: UAT-12197 exploits CVE-2026-20079 and plants a JSP web shell in the CSM Tomcat webroot, then drops a malicious JAR used to pull authentication data and credentials. UAT-11823 shows tooling overlap / TTP-consistent activity with Sandworm (Cyclops Blink–family implant behavior after initial access via one of the two FMC flaws). UAT-11988 is TTP-consistent with a Qilin ransomware affiliate pattern: static-credential login via CVE-2026-20316, living-off-the-land recon, credential theft, AV killers, and ransomware delivery. Report the cluster IDs as Talos named them; do not overclaim courtroom attribution from tooling overlap alone.

Why This Matters Operationally

FMC is the management plane for Cisco Secure Firewall estates. An attacker with root on FMC controls policy and logging for every managed firewall and can pull their configs and credentials. Pairing a CVSS 10.0 auth bypass now in KEV with concurrent static-credential abuse explains why both nation-state–style and ransomware-shaped clusters showed up on the same surface. Internet-exposed FMC management interfaces remain the highest-risk deployment pattern.

What Defenders Should Verify First

• Inventory every on-prem FMC / SCC Firewall Management instance and confirm the hotfixes for CVE-2026-20079 are installed with version evidence—Cisco refreshed IoCs and exploitation language through July–September.
• Remove Internet reachability to the FMC management interface immediately if it is still exposed; treat that as containment, not a substitute for the hotfix.
• Run Cisco’s compromise checks from the advisory. Treat presence of /var/tmp/license.tmp or matching IoCs as incident-grade and engage Cisco TAC for forensic triage per BOD 26-04 expectations.
• Hunt for unexpected Tomcat webroot JSP/JAR drops under CSM paths, reverse shells, Cyclops Blink–consistent implants, unexpected admin or credential exports, and outbound C2 from FMC management hosts.
• Correlate any prior CVE-2026-20316 static-credential exposure: rotate credentials, review sessions, and assume recon or ransomware staging if Qilin-shaped TTPs appear post-login.
• Apply referenced hotfixes now; plan for Cisco’s broader hardening release the week of September 16, but do not wait on it.

Source Context

• Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2 (CVE-2026-20079)
• Help Net Security: Cisco FMC bugs exploited by nation-state and ransomware actors
• SecurityWeek: Organizations warned of Cisco Secure FMC exploitation (UAT-12197 / UAT-11823 / UAT-11988)
• CISA KEV: CVE-2026-20079 added September 9, 2026

Patch FMC for CVE-2026-20079 today, take the management interface off the internet, and run forensic triage on any FMC that was reachable.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].