Cisco Confirms CVE-2026-20079 in FMC Actively Exploited by Sandworm and Qilin

Cisco confirmed on September 9, 2026 that the vulnerability CVE-2026-20079 in Secure Firewall Management Center is actively exploited in real-world attacks. The company identified two distinct threat clusters — an APT with overlap to Sandworm and a ransomware operator affiliated with Qilin — exploiting the same authentication flaw with a CVSS 10.0 score to achieve root command execution on target systems.

The Flaw: Authentication Bypassed at Boot with Root Execution

CVE-2026-20079 carries a CVSS 10.0 rating, the maximum score. According to information released by Cisco PSIRT and reported by BleepingComputer, the vulnerability stems from an improper system process created during the system boot phase. An unauthenticated remote attacker can send crafted HTTP requests to the Secure FMC web interface to completely bypass authentication controls and execute scripts and commands with root privileges.

The severity is amplified by the nature of the affected product: the Firewall Management Center is the centralized management panel for Cisco firewall appliances, not an isolated endpoint. Whoever gains control obtains visibility and potential manipulation over network policies, compromise indicators, and security configurations across the entire protected infrastructure.

Two Actors, Same Flaw: The Rare Alignment of APT and Ransomware

Technical analysis published by Cisco Talos documents two distinct intrusion chains converging on the same vulnerability. The first cluster, UAT-11823, is an advanced persistent actor that Talos links with high confidence to instrumental overlaps with the APT Sandworm, a group historically associated with the Russian GRU and active in strategic sabotage and espionage operations.

UAT-11823 deployed a JSP web shell with a Base64 decoding mechanism for the parameter F6C1F0E7 to dynamically load Java classes. Talos published the complete backdoor source code. From the same cluster comes the exfiltration of internal database credentials via the JAR cmd.jar with query SELECT name, auth_data FROM users, the opening of a Netcat reverse shell to address 208.123.119.215:3090, and deployment of a variant of the Cyclops Blink malware — a modular ELF implant family previously attributed to Sandworm — with persistence in /etc/init.d/.

The second cluster, UAT-11988, represents a completely different profile. Talos assesses it with high confidence as a ransomware operator whose TTPs in the victim environment are consistent with Qilin affiliates. This actor exploited CVE-2026-20316 — a separate static credentials vulnerability with CVSS 5.3 — for initial access, proceeding with Active Directory reconnaissance, SOCKS5/SSH tunneling, and final deployment of Qilin ransomware. The two actors share the same IoCs (including license.tmp and package_info.pl) and the same hot fixes, suggesting the Secure FMC attack surface has become a multi-use entry point in the exploit marketplace.

"Due to Talos identifying in the wild abuse of these CVE's, customers are strongly advised to apply hotfixes" — Cisco Talos

Timeline and Discovery: Exploitation Dating Back to at Least July

A log entry dated July 23, 2026, reported by BleepingComputer, shows execution of package_info.pl /var/tmp/license.tmp --lsm with root privileges by the www process. This IoC precedes Cisco PSIRT's official awareness, set in August 2026, by over a month and indicates the vulnerability was actively exploited before the vendor acknowledged in-the-wild abuse.

On September 9, 2026, CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog, imposing a forensics triage requirement per BOD-26-04 for Federal Civilian Executive Branch agencies. The deadline for patch application is set for September 12, 2026. Cisco also announced a "comprehensive hardening release" scheduled for the week of September 14-16, 2026, whose technical details have not yet been fully specified.

What to Do Now

• Immediate upgrade: Cisco has not released alternative workarounds; the only documented mitigation is applying hot fixes available for supported Secure FMC versions
• Mandatory forensic triage: Hot fixes do not remediate prior compromises; Cisco TAC must be engaged to verify whether the system was previously compromised, with attention to IoCs license.tmp, package_info.pl, and connections to 208.123.119.215:3090
• Network-based detection: Cisco Talos released Snort signatures SID 66075-66080 to detect known exploitation attempts; these must be deployed on network sensors covering traffic to the FMC management interface
• Assess CVE-2026-20316 chain: Since UAT-11988 exploited CVE-2026-20316 in combination with CVE-2026-20079, verify presence of access via compromised static credentials and search for indicators of SSH/SOCKS5 lateral movement

Why the Convergence of APT and Ransomware Changes the Risk Assessment

The coexistence of Sandworm and Qilin on the same enterprise vulnerability is not accidental sharing. It signals that CVE-2026-20079 has crossed the threshold separating APT-reserved flaws from commodity vulnerabilities: it has become shared infrastructure, an entry point that operators with diametrically opposed objectives — strategic sabotage and criminal monetization — find economically worthwhile to exploit.

For security leaders this shifts the problem from the traditional "are we an APT target?" to "is our attack surface appetizing to anyone with an exploit kit." When a flaw in the firewall management panel becomes accessible to two such different threat ecosystems, patching is no longer a question of risk profile based on sector or geography. The profile becomes universal.

Sources

• https://www.bleepingcomputer.com/news/security/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/
• https://blog.talosintelligence.com/fmc-ongoing-exploitation/
• https://isc.sans.edu/diary/rss/33314
• https://blog.netmanageit.com/cisco-confirms-cve-2026-20079-secure-fmc-flaw-exploited-in-attacks/
• https://thehackernews.com/2026/07/cisco-fmc-zero-day-actively-exploited.html
• https://socprime.com/blog/cve-2026-20316-cisco-fmc-zero-day-exploited/
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Information verified against cited sources and current as of publication.

Sources