The console that manages every Cisco Secure Firewall in your enterprise — the one that holds your entire firewall policy, your managed-device credentials, and your network topology — is being actively exploited by both a Russian military intelligence unit and the ransomware operation that led global attack volume for four consecutive quarters. Cisco Talos confirmed three separate clusters exploiting FMC in its September 9, 2026 disclosure.

Cisco Talos disclosed on September 9, 2026 that it had tracked three separate attacker clusters exploiting a pair of vulnerabilities in Cisco Secure Firewall Management Center software (FMC) — the on-premises platform used by enterprises, managed service providers, and government agencies to centrally administer their Cisco firewall fleets. One cluster overlaps in tooling with Sandworm, the Russian GRU hacking unit attributed to NotPetya and attacks on Ukraine’s power grid; another is assessed with high confidence to be an affiliate of Qilin, currently the world’s most prolific ransomware-as-a-service operation. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-20079 to its KEV catalog and set today, September 12, as the mandatory patch deadline for federal civilian agencies.

The reason these attackers are converging here is not coincidence. A Cisco FMC instance is not just another server in the rack — it is the administrative authority for every Cisco Secure Firewall device it manages, which means it holds the keys to every policy, every credential, and every configuration across an organization’s entire firewall fleet. One breached FMC does not mean one compromised device. It can mean the attacker is now looking through the eyes of your entire perimeter.

One Breached Console, Every Firewall Policy in the Building

Cisco FMC is a centralized management platform for Cisco Secure Firewalls, supporting application control, intrusion prevention, URL filtering, and anti-malware policy across enterprise-wide deployments. It is designed for medium-to-large enterprises that need to manage multiple Cisco firewall appliances from a single administrative console — including the full configuration of what traffic is allowed or blocked across every managed device. For attackers, it is a force-multiplier target: compromise the manager, and the firewalls themselves become a vantage point rather than a barrier.

The exploitation campaign is built on two flaws in the on-premises version of Cisco Secure FMC Software. Neither affects the cloud-delivered FMC, Cisco ASA Software, Firewall Threat Defense Software, or Security Cloud Control.

The first and more severe is CVE-2026-20079, which carries a CVSS score of 10.0 — the maximum possible on the standard severity scale. The Cisco advisory for CVE-2026-20079 classifies the vulnerability under CWE-288, an authentication bypass using an alternate path. An attacker needs no password and no prior foothold. A crafted HTTP request sent to the FMC web management interface is enough to bypass authentication entirely and execute scripts on the device with root privileges. Cisco first disclosed the flaw on March 4, 2026, and patches were available at that time — but the advisory confirms August 2026 exploitation, meaning attackers were inside unpatched FMC instances for weeks before the security community received a public warning, with indicators of compromise suggesting exploitation dates to at least July 23, 2026.

The second flaw, CVE-2026-20316, has a CVSS score of 5.3 — moderate in isolation — but carries a High Security Impact Rating from Cisco because of what it enables when chained. The Cisco advisory for CVE-2026-20316 classifies it as CWE-259: hard-coded login details for a low-privileged account were baked directly into the FMC web interface. An unauthenticated attacker can log in using those credentials and access sensitive data. Combined with a second vulnerability — specifically CVE-2026-20079 or the package_info.pl execution path described below — that low-privilege foothold escalates to full root access. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog on July 29, 2026, weeks before CVE-2026-20079 joined the same list. Attackers had a working entry point into FMC devices for more than a month before the more dangerous authentication bypass was publicly confirmed as exploited.

It is also worth noting the pattern: this is Cisco FMC’s third KEV entry in 2026, following CVE-2026-20316 and CVE-2026-20131, a Java deserialization remote code execution flaw that Interlock ransomware was found exploiting 36 days before it was publicly disclosed. The FMC management plane has become a recurring target category, not a one-time incident.

Cluster One: Credential Theft via Web Shell and Database Query

The first attacker cluster, which Talos tracks as UAT-12197, focused on intelligence collection rather than immediate disruption. Talos documented UAT-12197’s full post-exploitation chain in its September 9 disclosure.

After exploiting CVE-2026-20079 to gain unauthenticated access, UAT-12197 placed a JSP-based web shell in the Cisco Security Manager Tomcat webroot directory. The web shell dynamically loaded Java classes by Base64-decoding a parameter value — a technique that avoids writing obvious bytecode to disk. From that foothold, the cluster dropped a malicious Java Archive file named cmd.jar into the same directory. The JAR file is a command executor: it accepts a command-line argument and runs it through /bin/sh, the Linux system shell. The attackers used it to run a specific query against FMC’s internal database: SELECT name, auth_data FROM users — extracting the authentication data for every account on the compromised FMC instance. Those credentials become entry points into every downstream network and device the FMC manages.

Cluster Two: Sandworm Plants Cyclops Blink — Again

The second cluster is the one with the most significant national security implications. Talos attributes it to UAT-11823 with high confidence, citing substantial tooling overlap with Sandworm — the Russian military intelligence unit formally identified as GRU Unit 74455 and previously attributed by U.S. and UK agencies to the NotPetya wiper, the 2015 and 2016 attacks on Ukrainian electricity infrastructure, and the 2018 Winter Olympics cyberattacks. The CISA/NCSC Sandworm attribution advisory documents the group’s prior tooling and attribution.

UAT-11823 used both CVE-2026-20079 and CVE-2026-20316 to gain access. The group’s post-exploitation technique centered on a specific abuse of FMC’s built-in tooling: the attackers replaced the license.tmp file on disk with a Makeself self-extracting archive containing a malicious payload, then triggered its execution with root privileges by invoking package_info.pl — a legitimate Cisco utility used for license management — with the --lsm argument. The result was a Netcat-based reverse shell connecting back to command-and-control infrastructure. This is a textbook living-off-the-land technique: a legitimate administrative tool, trusted by every endpoint-detection product on the server, executing attacker-controlled code as root.

The group also deployed two bash scripts that harvested the full configurations of all firewall devices managed by the compromised FMC, packaging the data into archives staged for later exfiltration — a network mapping operation consistent with preparing future intrusion campaigns.

The final payload was Cyclops Blink, a modular ELF implant previously attributed to Sandworm by the U.S. National Security Agency, CISA, the FBI, and the UK’s National Cyber Security Centre following a 2022 campaign against WatchGuard Firebox and ASUS routers. The NCSC Cyclops Blink malware analysis report documents the implant’s original capabilities in detail. The 2026 FMC variant carries the same signature hash (6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461) as samples previously documented. Its capabilities include persistence scripts registered in /etc/init.d/ (surviving device reboots), DNS-over-HTTPS for command-and-control IP resolution (encrypting C2 communications to blend with normal HTTPS web traffic), file upload and download, credential harvesting, arbitrary command execution, network scanning and discovery, and packet sniffing with configurable filters.

That last point matters strategically: Sandworm positioned Cyclops Blink not on an endpoint or a workstation, but on the management console that has network-wide visibility into firewall traffic. An implant with packet-sniffing capability on an FMC instance is an implant watching everything the firewalls it manages are designed to examine.

Cluster Three: Qilin Ransomware Uses the Management Plane as a Recon Platform

The third cluster, tracked as UAT-11988, demonstrates how ransomware operators have elevated their playbook by targeting security management infrastructure before they ever reach an endpoint. Talos assesses with high confidence that UAT-11988 is an affiliate of Qilin, the Russian-language ransomware-as-a-service operation that ranked as the most prolific ransomware collective globally for four consecutive quarters through Q2 2026, with at least 557 separate incidents documented from January through May 2026 alone.

UAT-11988 gained initial access using the static credentials associated with CVE-2026-20316 — the lower-severity flaw — and then used the same package_info.pl technique as UAT-11823 to achieve root execution. What followed was a methodical reconnaissance operation that used the FMC’s privileged position inside the network to map everything:

Host names, IP addresses, and directory structures across the environment; Active Directory service-account credentials and MySQL account credentials; domain account information; full computer object lists with hostname-to-IP mappings spanning domain controllers, ADFS servers, Exchange servers, file servers, and database servers.

All collected data was staged on the FMC server itself and exfiltrated via HTTP GET requests — leveraging the FMC’s existing outbound web connectivity rather than introducing new egress channels that might trigger anomaly detection.

Once reconnaissance was complete, UAT-11988 established persistent network access into the victim’s internal environment using a Python SOCKS5 proxy and a reverse-SSH tunnel from the FMC back to attacker infrastructure, forwarding the following ports: LDAP (389), LDAPS (636), Kerberos (88), SMB (445), NetBIOS (135), and WinRM (5985). That port list is a functional tunnel into the organization’s entire Active Directory environment — the authentication backbone for most enterprise networks.

The pre-ransomware phase then deployed Impacket and Invoke-TheHash (open-source tools widely used by penetration testers for Windows credential relay attacks), followed by custom antivirus-killer payloads designed to disable endpoint security software, and finally Qilin ransomware deployed against a carefully pre-assembled list of target endpoints. Talos has previously analyzed Qilin’s attack methodology in depth. The target list was not random: it was built from the reconnaissance data extracted from the FMC itself. The ransomware encrypted exactly the systems the attacker had already decided were most valuable.

Qilin’s victim list in 2026 has included Covenant Health (478,188 patient records exposed), the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (confirmed by Department of Justice as a major incident), and Doctor.com (approximately 205 GB of data claimed). Details on Qilin’s 2026 victim timeline confirm these incidents. No individual has been publicly charged in connection with Qilin operations, and no Qilin infrastructure has been seized in any announced law enforcement action.

What the Shared Target Reveals

Three attacker groups with different objectives — espionage, credential theft, and ransomware — ended up in the same place for the same reason: the FMC manages everything, and compromising it is worth more than compromising any single endpoint it oversees.

The living-off-the-land technique applied here deserves specific attention. Two of the three clusters — including the Sandworm-attributed group and the Qilin affiliate — both abused package_info.pl, a legitimate Cisco utility, to execute attacker-crafted payloads with root privileges. This is not a coincidence of tradecraft: it reflects a documented attacker preference for using trusted administrative tools to execute malicious code on appliances that security operations teams often monitor less aggressively than endpoint devices, because those tools should be running. Traditional signature-based endpoint detection, looking for known malicious binaries, would not flag a legitimate Cisco license-management tool being used to execute a Makeself archive.

The Cyclops Blink reappearance specifically signals a documented shift in Sandworm’s targeting strategy. When the UK NCSC and U.S. agencies first documented Cyclops Blink in February 2022, it was deployed against WatchGuard Firebox appliances and ASUS routers — network appliances used primarily in small-office and home-office environments. The NCSC Cyclops Blink malware analysis from 2022 covers that original campaign. The FMC deployment targets enterprise-grade security management infrastructure with network-wide administrative scope. Sandworm has adapted its documented implant for a new, higher-value platform category. SecurityWeek warned organizations about Cisco FMC exploitation as Talos published its findings.

Is My Organization Exposed?

The affected product is specifically the on-premises version of Cisco Secure FMC Software. Cloud-delivered FMC, Cisco Secure Firewall ASA Software, Firewall Threat Defense Software, and Security Cloud Control are explicitly confirmed as not affected by these vulnerabilities. The Cisco advisory for CVE-2026-20079 specifies the exact product scope.

Cisco has released hotfixes for affected versions (7.0, 7.2, 7.4, 7.6, 7.7, and 10.0) and strongly urges customers to apply them immediately without waiting for the comprehensive hardening release expected the week of September 14, 2026. Cisco has confirmed that no workaround exists for CVE-2026-20079 — restriction of management interface access to trusted networks reduces the attack surface but does not close the vulnerability.

For detection, Talos has published Snort SIDs 66075 through 66080 for CVE-2026-20079, Snort SID 66883 for CVE-2026-20316, and Snort SIDs 66960 and 66961 covering the associated malware families. Indicators of compromise — including file hashes for the JSP web shell, cmd.jar command executor, and Cyclops Blink binary, plus five confirmed attacker IP addresses — are available on the Talos public GitHub repository. The Talos blog’s complete IoC table includes all hashes and attacker IPs.

Administrators who cannot immediately patch should run an audit for: unexpected files in Tomcat webroot directories; any logs containing references to /var/tmp/license.tmp; unusual outbound connections from the FMC management appliance; and any use of package_info.pl with non-standard arguments. Cisco’s advisory notes that a log entry referencing /var/tmp/license.tmp may indicate the vulnerability has already been exploited. Any organization that finds that indicator should treat the FMC as fully compromised before trusting any policy it currently manages, and contact Cisco TAC for support.

CISA’s September 12 mandatory deadline applies to Federal Civilian Executive Branch agencies, but the exploited vulnerabilities are not limited to government networks. Any organization running an unpatched on-premises Cisco Secure FMC with a management interface reachable from untrusted network segments is a live target.

Frequently Asked Questions

What exactly does “compromising a Cisco FMC” mean for my organization?

Cisco Secure Firewall Management Center is the administrative console that manages your organization’s Cisco Secure Firewall devices centrally. Compromising it means an attacker gains access not just to one device but to the management authority over your entire Cisco firewall fleet — including all firewall policies, managed-device credentials, and network topology data. UAT-11988 demonstrated this by using their FMC access to enumerate domain controllers, Active Directory service accounts, Exchange servers, file servers, and database servers — information that would normally require breaching multiple individual systems. In effect, the FMC is the keys to the building.

How is Cyclops Blink different in this campaign compared to what Sandworm did in 2022?

When NCSC and U.S. agencies first documented Cyclops Blink in 2022, it was targeting WatchGuard Firebox appliances and ASUS routers — network equipment used primarily in small-office environments as botnet nodes. The 2026 FMC variant deploys the same modular ELF implant on enterprise-grade centralized security management infrastructure with network-wide administrative scope. It is the same tool on a higher-value platform. Because the FMC has packet-sniffing visibility into traffic passing through all managed firewalls, Cyclops Blink on an FMC instance functions as an espionage sensor positioned at the network perimeter rather than as a simple botnet node.

What should I check first if I think my Cisco FMC may already be compromised?

Cisco’s advisory identifies a specific log indicator: a reference to /var/tmp/license.tmp in FMC logs in expert mode. That file path was the mechanism both UAT-11823 (Sandworm) and UAT-11988 (Qilin) used to achieve root execution. If you find that log entry, treat the FMC as owned and do not trust the policies it is currently enforcing before conducting a compromise assessment. Also check for unexpected files in the Tomcat webroot directory, unusual outbound connections from the FMC appliance, and any package_info.pl invocations with non-standard arguments. Full indicators of compromise — file hashes and attacker IP addresses for all three clusters — are available at the Talos IoC GitHub repository.

Is Qilin ransomware specifically targeting Cisco FMC, or is this opportunistic?

The evidence suggests the Qilin affiliate (UAT-11988) identified CVE-2026-20316’s static credentials as a reliable entry point and specifically leveraged the FMC’s privileged position to conduct reconnaissance before deploying ransomware. This is consistent with Qilin’s documented pattern of targeting infrastructure where disruption creates maximum pressure — the group has attacked healthcare organizations, government agencies, and critical-infrastructure operators with a double-extortion model. The ZeroFox threat intelligence report on Qilin confirms this targeting approach. Gaining access through a firewall management console gives a ransomware affiliate a complete map of the network before they encrypt a single file. That is not opportunism; it is deliberate targeting of a reconnaissance advantage.