Attackers are rooting Cisco Secure Firewall Management Center through a CVSS 10.0 bypass

The first cluster's web shell keeps almost nothing on disk. Talos's sample is JSP, dropped in the CSM Tomcat webroot, and it Base64-decodes a request parameter named F6C1F0E7 into a class that a custom ClassLoader defines inside the running Java process and instantiates ^[5]. The working code arrives with each request. What stayed behind was a JAR in the same directory, and the command Talos recovered runs the appliance's own query tool against its own database: `/var/jre/bin/java -jar cmd.jar '/var/sf/bin/OmniQuery.pl -db mdb -e SELECT name, auth_data FROM users'` ^[6]. A hotfix closes the entry point without invalidating the rows already copied, so any FMC patched after exposure still owes an account rotation.

The third cluster never needed the bypass. Talos says UAT-11988 got in on the static credentials tracked as CVE-2026-20316, then used built-in FMC tooling to run reconnaissance across the victim environment, stand up tunnels, harvest credentials and assemble a list of endpoints to encrypt, with tradecraft matching Qilin affiliates ^[8]. So of the three clusters, two exploited the 10.0 and one entered through the 5.3 alone ^[11]. The 4.7 points separating the two scores ^[12] describe how hard the bug is to reach; the consequences that follow are a separate matter entirely.

Cluster two is the one that places this in a longer line of work. Talos says UAT-11823 chained both CVEs into a Netcat reverse shell and proxy tooling and finished by deploying a variant of Cyclops Blink, malware the United States and United Kingdom previously attributed to the Russian APT Sandworm ^[7]. Espionage tooling and an extortion crew are working the same appliance class in the same window.

The clock is Cisco's own. Hotfixes for both CVEs are already out for affected versions, and Talos is telling customers to apply them because of the in-the-wild abuse ^[9]. The consolidated hardening release, which folds those hotfixes together with further vulnerabilities Cisco found internally, lands the week of September 14 ^[10]. Sites that hold off to take one change instead of two leave an exploited authentication bypass open across that interval, on a device that reaches every firewall it manages.

The published analysis stays narrow on scale: three clusters are named, with a victim count, geography and date of first exploitation all left out ^[13]. Treat the campaign size as unmeasured. The detection problem is clearer. Signature-led hunting will find the web shell and the JAR in cluster one and the reverse shell in cluster two; it will not find UAT-11988, which did its reconnaissance and tunnelling with software Cisco shipped ^[8].