Cisco Talos published research this week on three separate hacking groups that broke into customers through two flaws in Cisco Secure Firewall Management Center, the central management server for Cisco firewalls. One group dropped ransomware. Another is tied to Sandworm, the hacking unit linked to Russian military intelligence. The third stole credentials through a web shell. All of this happened on security appliances, the products customers buy specifically to watch their perimeter.
The two flaws are CVE-2026-20079 and CVE-2026-20316. The first is an authentication bypass with a CVSS score of 10.0: an unauthenticated attacker on the network can run scripts as root on the FMC server. Cisco patched it in early March, and the second flaw, a static credential bug that lets an attacker log in with a low-privileged account, was disclosed in July. Cisco confirmed at the time that CVE-2026-20316 was under active exploitation but stayed vague about the authentication bypass, even after quietly adding the same file indicator to both advisories. The new Talos report fills that gap: a state-sponsored group was chaining both flaws together.
Three groups, three playbooks
Talos tracks the clusters as UAT-12197, UAT-11823, and UAT-11988, and each one used a different post-compromise playbook.
UAT-12197 exploited CVE-2026-20079 and planted a JSP web shell in the Tomcat webroot of Cisco Security Manager on the same server. From there they pushed a JAR file called cmd.jar that ran commands and queried internal databases for user authentication data. This is a credential-harvesting operation, simple and effective.
UAT-11823 is the one that should worry people most. Talos links it to Sandworm, the Russian military intelligence unit behind some of the most destructive attacks of the past decade. This group exploited both flaws and used a trick worth understanding: they replaced the license.tmp file on the device with a malicious copy, then got Cisco’s own package_info.pl utility to execute it as root. From that foothold they ran a Netcat reverse shell back to their infrastructure, collected configuration archives from managed devices, and installed a variant of Cyclops Blink, a modular Linux backdoor the US and UK agencies first attributed to Sandworm back in 2022. The variant provides persistent access, credential theft, and network traffic sniffing. A compromised firewall manager that sniffs traffic is about as bad as it gets.
UAT-11988 is the ransomware crew. Talos attributes this cluster with high confidence to Qilin ransomware affiliates. They logged in with the static credentials from CVE-2026-20316, then used legitimate FMC tooling for reconnaissance instead of dropping malware. Hostnames, IP addresses, Active Directory service account credentials, MySQL credentials, hostname-to-IP mappings, all collected and staged in files on the FMC server, then downloaded with plain HTTP GET requests. Once they had the map of the network, they set up a Python SOCKS5 proxy and a reverse SSH tunnel, forwarding ports for LDAP, Kerberos, SMB, NetBIOS, and WinRM. Impacket, Invoke-TheHash, and custom EDR killers came next, then Qilin ransomware on the selected endpoints.
Why firewall managers keep getting hit
An FMC appliance is close to the perfect target. It sits at the network edge, it holds credentials for every managed firewall, it sees traffic metadata across the whole estate, and many organizations treat it as trusted infrastructure that lives on a management VLAN with light monitoring. Attackers have noticed. Vulnerabilities in perimeter security products from Cisco, Palo Alto, Fortinet, and Ivanti have become the most reliable initial access vector of the past two years, precisely because these devices are exposed and rarely treated as suspect.
The Talos report also shows how far a single foothold can go when the attackers are patient. The Qilin operators never wrote custom malware for most of their operation. They used built-in tools, staged files on the compromised server, and let the device’s own trust relationships carry them deeper into the network. By the time ransomware started encrypting, the attackers had been mapping Active Directory for days.
What to do now
If you run Cisco Secure FMC, patch first and investigate second. Hotfixes for both flaws are available for releases 7.0 through 7.7 and 10.0, and Cisco is shipping a broader hardening release with additional fixes the week of September 14. Check for the known indicators: a modified /var/tmp/license.tmp, a home.jsp web shell, and a cmd.jar file in the CSM Tomcat webroot. Talos published Snort rules covering the exploits and the malware, with SIDs 66075 through 66080 for CVE-2026-20079 and 66883 for CVE-2026-20316. If you suspect compromise, Cisco says to contact TAC, and assume credentials stored on the FMC are burned until proven otherwise.
The broader lesson is older than this incident. Anything that holds management credentials for other devices needs the same monitoring and isolation you would give a domain controller. Patching is necessary but not sufficient. Firewall managers are infrastructure now, in the attacker’s mind and in the kill chain, and they should be treated accordingly.
Sources: Cisco Talos, BleepingComputer, SecurityWeek