Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

1. Executive summary

Cisco Talos has disclosed three distinct post-compromise activity clusters — two state-sponsored-linked and one crimeware/ransomware — actively exploiting two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC): CVE-2026-20079 (CVSS 10.0, CRITICAL, in CISA KEV since 2026-09-09, EPSS 75%) and CVE-2026-20316 (CVSS 5.3, in CISA KEV since late July 2026). CVE-2026-20079 is an authentication bypass (CWE-288) in the FMC web interface allowing an unauthenticated, remote attacker to execute script files and obtain root on the underlying OS; CVE-2026-20316 permits unauthenticated login via a low-privilege account and can be chained with other FMC flaws for privilege escalation. Observed outcomes include JSP web shells, credential theft from internal databases, a Cyclops Blink variant implant, and full Qilin ransomware deployment. FMC is a centralised management plane for Cisco Secure Firewall estates — compromise of a single FMC instance potentially exposes managed-device configurations and credentials across the environment, making this a priority-one issue for EMEA financial services running Cisco firewall infrastructure.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	Active exploitation of FMC vulnerabilities by ransomware and state-sponsored clusters, with confirmed credential theft and Qilin ransomware deployment in the wild, creates a plausible major-incident scenario at financial entities running affected FMC versions	Entities with exposed or compromised FMC instances should assess reportability now, not after ransomware detonation; preserve forensic evidence to support classification under DORA Art. 18
DORA Art. 24: digital operational resilience testing — general requirements	CISA KEV listing of both CVEs with confirmed in-the-wild exploitation by multiple actor clusters means these vulnerabilities must be treated as live, tested attack paths, not theoretical findings	Prioritise these CVEs in vulnerability management and threat-informed testing of the FMC management plane; verify hotfix deployment and validate that authentication bypass is no longer reachable
DORA Art. 28: ICT third-party risk — general principles	FMC and Cisco Security Cloud Control (SCC) Firewall Management are affected — SCC is a cloud-managed offering, engaging third-party/cloud service exposure for entities using SCC rather than on-prem FMC	Entities using SCC Firewall Management must confirm with Cisco that cloud-side mitigation is applied and understand their shared-responsibility position; review contract terms under DORA Art. 30 where mitigation ownership is unclear

No NIS2 or UK NIS article is directly engaged beyond generic incident-reporting duties; the item contains no fact distinctive to NIS2 Art. 21(2)(d) or Art. 23 beyond what would be true of any exploited vulnerability.

3. Technical analysis & attack chain

Vulnerability mechanics (confirmed, multi-source)

CVE-2026-20079 — CVSS 10.0 CRITICAL, CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CISA KEV (added 2026-09-09, due date 2026-09-12), EPSS 75%. Affects Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. An unauthenticated, remote attacker bypasses authentication in the web interface and executes script files on the affected device, obtaining root access to the underlying operating system. Disclosed March 2026 per SecurityWeek.
CVE-2026-20316 — CVSS 5.3. An unauthenticated, remote attacker logs into an affected device using a low-privilege (static credential) account to access sensitive data; Cisco states it is actively exploited, and it can be chained with other FMC vulnerabilities for privilege elevation. Added to CISA KEV in late July 2026. ANSSI/CERT-FR (CERTFR-2026-AVI-0950) characterises the impact as data confidentiality breach and security policy bypass.

Confirmed attack chains by cluster (Cisco Talos, single primary source — see caveat)

UAT-12197 (state-sponsored-linked): Exploits CVE-2026-20079 → deploys JSP-based web shells and a Java Archive (JAR)-based command executor → uses the command executor to query internal databases → obtains user authentication data and credentials.
UAT-11823 (state-sponsored-linked): Exploits both CVE-2026-20079 and CVE-2026-20316 → delivers a Netcat-based reverse shell → runs two bash scripts to harvest managed-device configurations → deploys a variant of Cyclops Blink, a modular ELF implant.
UAT-11988 (ransomware): Exploits CVE-2026-20316 for initial access → uses legitimate built-in FMC tooling in a living-off-the-land (LotL) approach for extensive environment reconnaissance → drops tunneling tools to maintain network access → collects credentials → builds a target list of endpoints to encrypt → terminates security tools → deploys Qilin ransomware on selected systems.

Defender-relevant specifics

Initial access vector: unauthenticated, remote — internet-exposed FMC web interfaces are the primary risk surface. Both CVEs are remotely exploitable without credentials.
Payloads: JSP web shells; JAR-based command executor; Netcat reverse shell; two bash configuration-harvesting scripts; Cyclops Blink variant (ELF implant); tunneling tools; Qilin ransomware.
Persistence: web shells (UAT-12197) and tunneling tools (UAT-11988) are the named persistence mechanisms.
Credential access: direct database queries via the JAR command executor (UAT-12197); credential collection via LotL tooling (UAT-11988); managed-device configuration harvesting via bash scripts (UAT-11823).
Impact: root-level OS access (CVE-2026-20079 chain); data confidentiality breach (CVE-2026-20316 chain); ransomware encryption of selected endpoints with prior security-tool termination.
Remediation status: Cisco has released hotfixes for both CVEs and intends to ship a comprehensive hardening release for additional internally discovered vulnerabilities the week of 2026-09-14.

Caveats and confidence notes

The three-cluster breakdown, payload descriptions, and the Cyclops Blink attribution are single-sourced to Cisco Talos via The Hacker News report; no second vendor or government source in the corpus corroborates the specific cluster-to-CVE mappings or the Cyclops Blink variant claim. The Cyclops Blink implant was previously attributed to Sandworm (Russian state-sponsored), but the verified reference data contains no MITRE ATT&CK profile for UAT-11823, UAT-12197, UAT-11988, or Sandworm — treat all cluster attributions as unconfirmed pending Talos' primary publication.
CISA KEV lists "Known ransomware campaign use: Unknown" for CVE-2026-20079; the Qilin deployment reported by Talos is associated with CVE-2026-20316 initial access. Do not conflate the two.
No IOCs (hashes, IPs, domains, filenames) are present in any source in this corpus.

4. Mitigation & containment

P1 — within 24 hours

Inventory and patch. Identify all FMC instances (on-prem) and SCC Firewall Management tenants. Apply Cisco hotfixes for CVE-2026-20079 and CVE-2026-20316 immediately. CISA KEV due date for CVE-2026-20079 is 2026-09-12 — one day from issuance of this advisory.
Kill external exposure. If hotfixes cannot be applied within 24h, remove FMC web interfaces from internet exposure (management-plane access should be via management network/VPN only). CISA's KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Hunt for compromise on FMC hosts. Assume any unpatched, internet-exposed FMC is compromised. Look for: JSP files in web-accessible paths (web shells); unexpected JAR files; Netcat processes/listeners; bash scripts harvesting managed-device configurations; ELF binaries matching Cyclops Blink variant behaviour; tunneling tools; signs of Qilin ransomware staging (target lists, security-tool termination).
Rotate credentials. Any FMC instance exposed during the exploitation window (roughly March 2026 disclosure onward; KEV listing for CVE-2026-20316 late July 2026) should have all managed-device credentials, FMC administrative accounts, and any credentials stored in FMC-managed databases rotated. UAT-12197's database queries targeted user authentication data.

P2 — within 72 hours

Review managed-device configurations for exfiltration indicators. UAT-11823 harvested managed-device configurations — assume firewall configurations (including any embedded secrets, PSKs, VPN configurations) are in adversary hands if compromise is confirmed.
Verify hotfix deployment across the full estate and confirm authentication bypass is no longer reachable (authenticated external scan / vendor verification tooling where available).
Prepare for the hardening release. Cisco's comprehensive hardening release for additional internally discovered FMC vulnerabilities ships the week of 2026-09-14 — schedule emergency change windows now.

P3 — within 7 days

Containment for confirmed compromise: isolate affected FMC hosts from the management network; rebuild rather than clean where root-level access (CVE-2026-20079) is confirmed; block known tunneling egress at the network perimeter; validate integrity of managed firewall devices before trusting their configurations.
Threat-informed testing. Validate that the patched FMC rejects unauthenticated access attempts on the web interface; incorporate the LotL techniques (built-in FMC tooling abuse) into purple-team scenarios for management-plane assets.
Reportability assessment. Where compromise is confirmed at a DORA-scoped entity, complete classification under DORA Art. 18 and assess reporting under DORA Art. 19.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
Unauthenticated script execution on FMC web interface (CVE-2026-20079 exploitation)	FMC web server logs; anomalous unauthenticated requests to the management interface	High — vulnerability mechanism confirmed by NVD/CISA
JSP web shell deployment and JAR-based command executor execution	FMC host filesystem (web-accessible directories); Java process execution with unexpected JAR paths	Medium — single-sourced to Talos
Netcat-based reverse shell activity	FMC host process list; outbound connections from FMC host on unusual ports	Medium — single-sourced to Talos
Bash scripts harvesting managed-device configurations	FMC host shell history; script execution; bulk configuration file access	Medium — single-sourced to Talos
Cyclops Blink variant ELF implant execution	FMC host (Linux) process activity; unknown ELF binaries	Low — single-sourced; attribution to Sandworm unconfirmed
Legitimate built-in FMC tooling used for reconnaissance (LotL)	FMC audit logs — legitimate tool execution in anomalous contexts/times	Medium — single-sourced to Talos
Tunneling tool deployment for network access maintenance	FMC host; outbound network connections; new services/processes	Medium — single-sourced to Talos
Security tool termination followed by Qilin ransomware deployment	EDR logs; process termination events; ransomware file encryption activity	Medium — single-sourced to Talos

6. Detection

Insufficient indicators to author detection rules. The sources describe cluster behaviour and payload classes (JSP web shells, JAR command executor, Netcat reverse shell, bash scripts, Cyclops Blink variant, Qilin) but provide no filenames, paths, strings, hashes, command lines, or registry keys from which a non-fabricated YARA or Sigma rule could be built. We will re-issue detection content if Talos' primary publication includes artefacts.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-20079	10.0 Critical	⚠ KEV 2026-09-09	75%	A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated,…

7. Sources

The Hacker News — Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware — https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html — 2026-09-11
Help Net Security — Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) — https://www.helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316/ — 2026-09-10
ANSSI France CERT — Vulnérabilité dans Cisco Firewall Management Center (CERTFR-2026-AVI-0950) — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0950/ — 2026-07-30
BleepingComputer — Cisco warns of FMC static credential flaw exploited in zero-day attacks — https://www.bleepingcomputer.com/news/security/cisco-warns-of-fmc-static-credential-flaw-exploited-in-zero-day-attacks/ — 2026 (undated in corpus)
NVD / CISA KEV — CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Authentication Bypass Using an Alternate Path or Channel Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-20079 — KEV added 2026-09-09
SecurityWeek — Organizations Warned of Cisco Secure FMC Exploitation — https://www.securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation/ — 2026 (undated in corpus)
SecurityWeek — Cisco Secure FMC Zero-Day Exploited in the Wild — https://www.securityweek.com/cisco-secure-fmc-zero-day-exploited-in-the-wild/ — 2026 (undated in corpus)

8. Adverse Trace position

This is a critical, actively exploited management-plane compromise with a CVSS 10.0 authentication bypass (CWE-288) in CISA KEV with a 2026-09-12 remediation deadline and 75% EPSS, chained in the wild with a second KEV-listed flaw (CVE-2026-20316) by three distinct clusters — including a ransomware operator that reached full Qilin deployment and a cluster deploying a Cyclops Blink variant. For EMEA financial services, an FMC compromise is not a single-system event: it exposes managed-device configurations and authentication data across the firewall estate, and the ransomware cluster's LotL use of built-in FMC tooling means standard EDR on endpoints will not see the reconnaissance phase. The cluster-level detail is single-sourced to Cisco Talos and all actor attributions are unconfirmed pending primary publication — verify before enforcement action, but do not wait on attribution to patch: the vulnerability facts are multi-source corroborated and the KEV clock is running. Adverse Trace will monitor for Talos' primary publication and the Cisco hardening release expected the week of 2026-09-14, and will re-issue this advisory with IOCs and detection rules as soon as artefacts are published.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.