Active Exploitation of Cisco Secure Firewall Management Center

Cisco Talos is actively tracking the exploitation of multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) software. Threat actors are chaining CVE-2026-20079, a critical (CVSS 10.0) authentication bypass vulnerability, and CVE-2026-20316, which involves static credentials, to gain initial access and perform lateral movement. Talos has identified three distinct clusters of malicious activity. Cluster UAT-12197 utilizes CVE-2026-20079 to deploy JSP web shells and custom Java-based command executors for credential exfiltration. Cluster UAT-11823, identified as an APT with ties to Sandworm, uses these vulnerabilities to deploy Cyclops Blink malware via a malicious Makeself package. Cluster UAT-11988, assessed as a Qilin ransomware operator, uses static credentials for initial access followed by living-off-the-land (LOTL) techniques to conduct reconnaissance, deploy tunneling tools, and execute ransomware. Defenders must prioritize patching these vulnerabilities, as multiple groups are currently exploiting these flaws in the wild.

Attack Chain

1. Initial Access: Attackers bypass authentication via CVE-2026-20079 or utilize static credentials (CVE-2026-20316) to access the FMC appliance.
2. Persistence: Attackers place malicious JSP web shells in the CSM Tomcat webroot directory or modify system startup scripts (e.g., /etc/init.d/) to maintain access.
3. Execution: Attackers abuse the legitimate package_info.pl utility to execute malicious files (e.g., license.tmp) or custom JAR files (e.g., cmd.jar) with root privileges.
4. Privilege Escalation: Exploitation of system utilities allows actors to transition from initial low-privileged access to root-level command execution on the underlying OS.
5. Discovery: Attackers perform system and network reconnaissance, including directory listing, credential harvesting via OmniQuery.pl, and internal database queries.
6. Command and Control: Deployment of Netcat-based reverse shells and SOCKS proxy/reverse-SSH tunneling tools to maintain communication with actor infrastructure.
7. Impact: Final stages include exfiltration of configurations, deployment of modular implants like Cyclops Blink, or deployment of Qilin ransomware to target endpoints.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full administrative control over the FMC appliance. Observed impacts include the exfiltration of sensitive configuration data, deployment of modular botnet malware, and large-scale ransomware encryption of downstream enterprise networks.

Recommendation

1. Apply the security patches provided by Cisco for CVE-2026-20079 and CVE-2026-20316 immediately.
2. Implement monitoring for unauthorized files in the CSM Tomcat webroot directory.
3. Audit the use of system-level utilities like package_info.pl and OmniQuery.pl for anomalous command-line arguments.
4. Block communication with the known C2 IP 208.123.119.215 at the network perimeter.
5. Monitor for processes spawning unexpected shells or network utilities such as nc (Netcat).