Build1 publisher3 min readPublished
Three intrusion clusters reached the same Cisco console through one CVSS 10.0 bypass
Cisco patched CVE-2026-20079 in March 2026 and confirmed in September that attackers had used it in August. Talos ties three clusters to the console, including one it links to Sandworm tooling and a Qilin affiliate.
The Engineer · Build desk
What happened
- Cisco rates CVE-2026-20079 at CVSS 10.0: an unauthenticated remote attacker sends a crafted HTTP request to the Firewall Management Center web interface and executes scripts as root on the host OS.
- Cisco fixed and disclosed the flaw in March 2026 with no evidence of exploitation, then updated the advisory on 9 September to confirm exploitation had been observed in August.
- Cisco Talos identified three separate intrusion clusters using the bug, one it links with high confidence to Sandworm tooling and one it assesses with high confidence as a Qilin ransomware affiliate.
- CISA added the CVE to its Known Exploited Vulnerabilities catalog on 9 September 2026 with a federal remediation deadline of 12 September 2026.
- VulnCheck counted roughly 300 to 700 FMC instances exposed to the internet in March 2026, the only exposure figure on the record.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure The console holds the rule sets, log data and management credentials for the firewalls under it, so one root shell puts both the policy and the record of changes to it in the attacker's hands.
- constraint Patching a fleet means matching each appliance to one of six release branches and taking a maintenance window on the control that enforces policy, which is why these boxes sit unpatched for months.
- decision Talos told customers not to wait for the consolidated hardening release planned for the week of 14 September, so teams holding out for one clean upgrade have to schedule branch-matched hotfixes now.
- precedent The inventory question moves ahead of the patch question: how many management interfaces face the internet at all, counting cloud consoles, hypervisor managers and backup controllers alongside FMC.
Cisco describes the root cause as an improperly created system process that exists during boot, and that process leaves a route into the appliance that valid credentials are not needed to take [4]. The weakness is classified CWE-288, authentication bypass using an alternate path or channel [5]. The advisory is cisco-sa-onprem-fmc-authbypass-5JPp45V2 [6]. Its CVSS vector includes a scope change, because the compromise reaches the whole set of managed firewalls [14].
In Talos's account of the intrusions, most of the tooling came off the box. UAT-12197 dropped a JSP web shell into the CSM Tomcat web root, ran a JAR command executor, and pulled authentication data out of the FMC internal database with OmniQuery.pl, a script already installed on the appliance [16]. The intruder did not need to bring a database client. UAT-11823 chained the bypass with a second flaw, rewrote license.tmp so an installation tool would execute it as root, opened a Netcat reverse shell, collected the configurations of the managed firewalls, and installed a Cyclops Blink variant [17].
The second flaw is the one I would not have prioritised. CVE-2026-20316 is a static credential rated CVSS 5.3, which lets a low-privileged account log in and read sensitive data [11]. UAT-11988 used that credential to log in, mapped the environment with living-off-the-land tools, harvested credentials, deployed an antivirus killer, and delivered Qilin ransomware to selected endpoints [18]. Cisco fixed it on 29 July 2026, and CISA listed it in the KEV catalog the same day [12].
Five months separate the March fix from the August exploitation [1]. Federal agencies then had three days between the 9 September listing and the 12 September deadline [2]. The fix is branch-specific across 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, so the release in use has to be matched exactly [21]. Cisco shipped hotfixes on 31 July 2026 and planned a consolidated hardening release for the week of 14 September; Talos advised customers not to wait for it [20].
VulnCheck's exposure count is a March figure, and the source says it was not updated afterward [19]. For it to describe the September population, two things would have to hold: the number of internet-reachable consoles did not move across six months, and the exposed set was still running an unpatched branch. An attacker who owns FMC can rewrite rules, open paths through the perimeter, delete log evidence, and push malicious configuration to managed devices [15].
The retrospective check is cheap. In expert mode, run zgrep "package_info.license" /var/log/messages; if the output points to /var/tmp/license.tmp, Cisco says to treat the device as compromised and contact TAC [22]. The same check includes looking in the CSM Tomcat web root for unexpected JAR files [22].
What to watch
- Whether the consolidated hardening release landed in the week of 14 September 2026, and what it changes beyond the 31 July hotfixes.
- An updated internet-exposure count for FMC; VulnCheck's March 2026 range of roughly 300 to 700 is the only one in the record.
- Whether Talos adds clusters or attributes UAT-12197, the only one of the three without a named group behind it.