Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws
Summary
Cisco Talos has identified active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20079 and CVE-2026-20316. The exploitation has been linked to three separate post-compromise activity clusters tracked as UAT-12197, UAT-11823, and UAT-11988, involving credential theft, web shells, reverse shells, proxy infrastructure, Cyclops Blink malware, and Qilin ransomware.
CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0. It allows an unauthenticated remote attacker to bypass authentication and execute scripts to obtain root access on vulnerable FMC devices.
CVE-2026-20316 has a CVSS score of 5.3 and allows attackers to log in using static credentials associated with a low-privileged account. The vulnerability can be combined with other FMC vulnerabilities to elevate privileges.
The observed attacks demonstrate how compromise of an FMC device can provide attackers with access to network configuration information, credentials, internal network services, and pathways into the broader victim environment.
The three observed clusters followed different post-compromise objectives:
- UAT-12197 exploited CVE-2026-20079 to deploy a JSP web shell and a JAR-based command executor for credential theft.
- UAT-11823 exploited both vulnerabilities and deployed a Netcat reverse shell, proxy tooling, and a variant of Cyclops Blink, a malware family previously attributed to Sandworm.
- UAT-11988 used FMC access for reconnaissance, credential harvesting, tunneling, and ultimately deployment of Qilin ransomware on selected endpoints.
Cisco has released hotfixes for both vulnerabilities and recommends that affected customers apply them immediately. A broader hardening release containing these hotfixes and additional fixes is also planned.
Background of the Cisco FMC Exploitation Campaign
Cisco Talos began tracking three distinct clusters of post-compromise activity on Secure Firewall Management Center devices. Although the clusters used different tools and had different objectives, all demonstrate the potential consequences of compromising an FMC system.
UAT-12197: Web Shell and Credential Theft
UAT-12197 exploited CVE-2026-20079 and placed a malicious JSP web shell inside the Cisco Security Manager Tomcat webroot directory.
The web shell decodes a Base64-encoded parameter named
F6C1F0E7, which specifies the Java class to load. The attackers
then used the web shell to place a malicious JAR file named
cmd.jar in the same directory.
The JAR acted as a command executor and was used to query the internal database for user authentication information and credentials.
The command observed by Talos queried:
SELECT name, auth_data FROM users;
This activity demonstrates how the initial authentication bypass could be followed by persistence, command execution, and credential theft.
UAT-11823: Sandworm-Linked Activity and Cyclops Blink
UAT-11823 was assessed with high confidence as an advanced persistent threat actor whose tooling overlaps with the Sandworm APT group.
The attackers obtained access either by exploiting CVE-2026-20079 or by using static credentials associated with CVE-2026-20316.
After gaining access, they replaced the license.tmp file with a
malicious Makeself package. The package established a Netcat-based reverse shell
to attacker-controlled infrastructure and was executed with root privileges through
the legitimate package_info.pl utility.
Talos assessed with high confidence that UAT-11823 exploited both CVE-2026-20079 and CVE-2026-20316.
The attackers also deployed scripts to collect managed-device configuration information and stage it into archives for later exfiltration.
The intrusion ultimately involved a modular ELF variant of Cyclops Blink, a malware family previously attributed to Sandworm. The observed variant provided capabilities including persistence, credential harvesting, arbitrary command and file execution, network discovery, file transfers, DNS-over-HTTPS IP resolution, and packet sniffing.
UAT-11988: Qilin Ransomware Operations
UAT-11988 was assessed with high confidence as a ransomware operator, with its observed tactics, techniques, and procedures consistent with Qilin ransomware affiliates.
The operator gained access to an FMC device using static credentials associated with CVE-2026-20316 and then abused legitimate FMC functionality in a living-off-the-land manner.
The attackers performed extensive reconnaissance and collected:
- Hostnames and IP addresses
- Directory listings
- Active Directory service-account credentials
- MySQL credentials
- Domain account information
- Computer object lists
- Hostname-to-IP mappings for domain controllers, ADFS, Exchange, file servers, and database servers
The collected information was staged on the compromised FMC and exfiltrated using HTTP GET requests.
The attackers then established a Python SOCKS5 proxy and reverse SSH tunnel to access internal systems. They forwarded services including LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM.
After additional endpoint probing, the attackers deployed tools including Impacket, Invoke-TheHash, and custom antivirus/EDR killers before deploying Qilin ransomware on selected endpoints to encrypt files.
Vulnerability Details
| CVE | Vulnerability | CVSS | EPSS | Impact |
|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass in Cisco Secure FMC | 10.0 | 74.70% | An unauthenticated remote attacker can bypass authentication and execute scripts to obtain root access. |
| CVE-2026-20316 | Static credentials for a low-privileged account | 5.3 | 11.15% | A remote attacker can log in using the low-privileged account and potentially combine the vulnerability with other FMC vulnerabilities to elevate privileges. |
Both vulnerabilities were being actively exploited in the wild when Cisco Talos published its September 2026 analysis. Cisco had already released hotfixes for affected versions and urged customers to apply them.
Attack Methodology
The observed attacks can be summarized as follows:
Phase 1: Initial Access
Threat actors gained access to vulnerable Cisco Secure FMC systems through:
- CVE-2026-20079, which provides an authentication bypass.
- CVE-2026-20316, which provides access through static credentials associated with a low-privileged account.
UAT-11823 was assessed with high confidence to have exploited both vulnerabilities. UAT-11988 accessed the FMC using credentials associated with CVE-2026-20316.
Phase 2: Privilege and Command Execution
Attackers abused access to execute commands on the FMC device.
UAT-12197 deployed a JSP web shell and cmd.jar, while UAT-11823
and UAT-11988 abused the legitimate package_info.pl utility to
execute attacker-controlled packages with root privileges.
Phase 3: Web Shell Deployment
UAT-12197 placed a JSP web shell in the CSM Tomcat webroot.
The web shell decoded the F6C1F0E7 parameter and loaded a specified
Java class, providing attackers with command execution capabilities.
Phase 4: Credential Theft
The attackers used cmd.jar to query the internal FMC database
for user authentication data.
Other activity included harvesting Active Directory service-account credentials, MySQL credentials, and domain account information.
Phase 5: Reverse Shell Establishment
UAT-11823 replaced license.tmp with a malicious Makeself package
that established a Netcat reverse shell.
The package was executed through:
/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
This activity provided the attackers with interactive access to the compromised system.
Phase 6: Configuration Collection
UAT-11823 deployed bash scripts to collect managed-device configurations and stage the information into archives for later exfiltration.
Phase 7: Reconnaissance
UAT-11988 performed extensive reconnaissance of the victim environment, collecting hostnames, IP addresses, directory information, domain information, computer objects, and mappings of critical internal infrastructure.
Phase 8: Network Tunneling
UAT-11988 deployed a Python SOCKS5 proxy and reverse SSH tunnel to maintain access to internal systems.
The attackers forwarded:
- LDAP — TCP 389
- LDAPS — TCP 636
- Kerberos — TCP 88
- SMB — TCP 445
- NetBIOS — TCP 135
- WinRM — TCP 5985
Phase 9: Malware Deployment
UAT-11823 downloaded and deployed a modular ELF variant of Cyclops Blink.
The malware supported persistence, credential harvesting, file transfers, command execution, network discovery, and packet sniffing.
Phase 10: Pre-Ransomware Activity
UAT-11988 used post-exploitation tools including Impacket, Invoke-TheHash, and custom AV/EDR killers to prepare targeted endpoints for ransomware deployment.
Phase 11: Ransomware Deployment
The final stage of the UAT-11988 intrusion involved deploying Qilin ransomware to selected endpoints to encrypt files.
Indicators of Compromise (IOCs)
Cisco Talos published the following indicators associated with the three clusters.
| IOC | Cluster | Description |
|---|---|---|
B037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d
|
UAT-12197 | home.jsp web shell |
Db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e
|
UAT-12197 | cmd.jar JAR-based command executor |
89.34.96[.]56 |
UAT-11823 | Netcat reverse-shell / Cyclops Blink C2 |
208.123.119[.]215 |
UAT-11823 | Netcat reverse-shell C2 |
104.218.165[.]253 |
UAT-11823 | Attacker vulnerability scanner for CVE-2026-20079 |
91.214.78[.]118 |
UAT-11823 | Netcat reverse-shell C2 |
6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461
|
UAT-11823 | Cyclops Blink malware |
43.204.2[.]142 |
UAT-11988 | Attacker IP address used during intrusions |
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1505.003 | Server Software Component: Web Shell | Persistence |
| T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution |
Visual Attack Flow
Cisco Secure FMC
|
+-------------+-------------+
| |
CVE-2026-20079 CVE-2026-20316
Authentication Bypass Static Credentials
| |
+-------------+-------------+
|
FMC Compromise
|
+----------------+----------------+
| | |
UAT-12197 UAT-11823 UAT-11988
| | |
JSP Web Shell Netcat Shell Reconnaissance
| | |
cmd.jar license.tmp Credential Theft
| | |
Credential Theft package_info.pl SOCKS5 / SSH
| |
Cyclops Blink Impacket /
| Invoke-TheHash
| |
| AV/EDR Killers
| |
| Qilin Ransomware
|
Persistent Access
Mitigation
-
Patch affected Cisco Secure Firewall Management Center deployments immediately.
Apply the available Cisco hotfixes or upgrade to a fixed software release for CVE-2026-20079 and CVE-2026-20316. Prioritize internet-accessible or externally exposed FMC deployments because both vulnerabilities have been exploited in the wild. -
Restrict access to the FMC management interface.
Limit access to the FMC management interface to trusted networks and authorized administrators. Avoid exposing the management interface directly to untrusted or internet-based networks wherever possible. -
Hunt for signs of exploitation on affected FMC systems.
Review FMC logs for suspicious activity, including references to/var/tmp/license.tmp. Cisco recommends checking/var/log/messagesfor unexpectedlicenseactivity and correlating findings with other suspicious events. -
Investigate compromised FMC devices for unauthorized activity.
Review affected FMC systems for unexpected files, commands, web shells, packages, configuration changes, or unauthorized access. If compromise is suspected, investigate the system before considering the device fully remediated and follow Cisco's recommended incident-response and recovery procedures.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
