Cisco FMC Zero-Days Exploited by Sandworm and Qilin Ransomware

Technical Analysis

Cisco Talos has issued an emergency threat advisory detailing active, in-the-wild exploitation of two vulnerabilities affecting Cisco Secure Firewall Management Center (FMC) Software. The primary vector, CVE-2026-20079, represents a critical authentication bypass flaw carrying a maximum CVSS score of 10.0. This vulnerability enables an unauthenticated remote adversary to bypass authentication controls and execute arbitrary scripts on affected devices, achieving unrestricted root access on the underlying operating system.

The secondary vulnerability, CVE-2026-20316 (CVSS 5.3), permits remote authentication utilizing static or low-privileged credentials. When chained with CVE-2026-20079, threat actors abuse legitimate management utilities—specifically the internal perl script /usr/local/sf/bin/package_info.pl—to achieve root privilege escalation. By directing package_info.pl to process an attacker-supplied Makeself archive masquerading as a temporary license file (/var/tmp/license.tmp), adversaries execute arbitrary root-level shell commands, completely undermining perimeter security perimeters.

Attack Vector & Impact

Telemetry from Cisco Talos tracks three discrete intrusion clusters actively weaponizing these vulnerabilities across state-sponsored espionage and extortion campaigns:

Cluster 1: UAT-12197 Credential Exfiltration

Adversaries exploit CVE-2026-20079 to implant a JSP web shell (home[.]jsp) into the CSM Tomcat webroot directory. The web shell decodes a Base64 payload parameter to drop a malicious Java Archive executor (cmd[.]jar). The threat actors invoke OmniQuery.pl to query the management appliance's internal MySQL database, exfiltrating encrypted password hashes, user credentials, and administrative authentication material.

Cluster 2: Sandworm APT & Cyclops Blink Deployment

Attributed with high confidence to Russian state-sponsored threat group Sandworm (tracked as UAT-11823), operators leverage CVE-2026-20079 and CVE-2026-20316 to establish persistent Netcat-based reverse shells connecting to command-and-control (C2) infrastructure at 208.123.119[.]215 and 89.34.96[.]56. Operators subsequently deploy a modular ELF implant identified as Cyclops Blink. This implant establishes persistence via /etc/init.d/, conducts DNS-over-HTTPS (DoH) command-and-control resolution, extracts managed firewall configurations, and executes packet sniffing across internal subnets.

Cluster 3: Qilin Ransomware Pre-Extortion Reconnaissance

A third intrusion cluster, attributed to Qilin ransomware affiliates (UAT-11988), utilized static credentials (CVE-2026-20316) and package_info.pl abuse to harvest Active Directory domain controllers, service account secrets, and server infrastructure mappings. The operators established a Python SOCKS5 proxy (socks5.py) and reverse-SSH tunnel, forwarding core enterprise ports including LDAP (389), Kerberos (88), SMB (445), and WinRM (5985) directly into the internal network. Operators deployed open-source lateral movement tools including Impacket, Invoke-TheHash, and custom antivirus termination tools prior to staging final Qilin ransomware payloads.

Detection & Mitigation

Urgent Patching & Hotfix Deployment

Organizations running Cisco Secure FMC Software must immediately apply vendor-released hotfixes for CVE-2026-20079 and CVE-2026-20316. Cisco is scheduling a comprehensive security hardening release the week of September 14, 2026; however, active exploitation mandates immediate out-of-cycle hotfix installation.

Perimeter Auditing & Snort Signature Implementation

Network defenders must verify network perimeters and deploy relevant intrusion prevention rules:

• Snort SIDs for CVE-2026-20079: 66075 through 66080.
• Snort SIDs for CVE-2026-20316: 66883.
• Snort SIDs for Cyclops Blink and related malware: 66960, 66961.

Inspect FMC storage directories for unauthorized files, particularly /var/tmp/license.tmp, standalone JAR binaries in the Tomcat webroot, and anomalous Python proxy scripts (socks5.py). Any FMC appliance exhibiting unexpected outbound SSH, Netcat, or DoH traffic to untrusted external IPs must be quarantined and subject to full incident response forensic procedures.