Cisco's Firewall Manager Just Logged Its Third CISA KEV of 2026. This Time, Three Different Attackers Got There First.
Talos found a suspected Russian state actor deploying Cyclops Blink, a Qilin ransomware affiliate raiding Active Directory, and a third crew harvesting credentials — all inside the same two Cisco Secure FMC bugs, discovered within weeks of each other.
CVE Tools5 min read
Cisco Secure Firewall Management Center (FMC) is not a firewall. It's the console that pushes policy to every Firepower box it manages — which is exactly why, for the third time in 2026, it's the reason CISA is telling federal agencies to drop everything and patch. On September 9, Cisco Talos published something unusual: not one attack, but three separate, unrelated intrusion clusters, using the same two authentication bugs, caught operating on FMC devices at roughly the same time.
The bugs: one lets anyone in, the other lets anyone log in
CVE-2026-20079 is an authentication bypass in FMC's web interface, caused by an improperly created system process at boot time. An unauthenticated attacker sends crafted HTTP requests and comes out the other side with root on the underlying OS — no login required. CVE-2026-20316 is simpler and dumber: FMC ships a hard-coded, low-privilege account. Cisco scored it a 5.3 but overrode its own math to rate it High severity, because — as it warned in July — the account can be chained with other FMC bugs to escalate privileges. Talos' September report is that warning coming true.
FMC's year: three zero-days, three CISA deadlines
FMC's three KEV entries of 2026
- Interlock ransomware starts exploiting an undisclosed FMC bugAmazon's MadPot honeypots later showed Interlock affiliates using what became CVE-2026-20131, weeks before Cisco knew about it.
- Cisco discloses CVE-2026-20131 and CVE-2026-20079 the same dayCVE-2026-20131 is a Java-deserialization RCE; CVE-2026-20079 is the auth bypass this article covers.
- CISA adds CVE-2026-20131 to KEVFederal deadline March 22 — three days later — after Cisco confirmed the Interlock exploitation.
- Earliest known CVE-2026-20079 exploitation, per Cisco's own IOC logsPublished later in a July advisory update; Cisco's own PSIRT didn't clock the activity until August.
- Cisco discloses CVE-2026-20316; CISA KEVs it the same dayFederal deadline August 1 — the hard-coded low-privilege account.
- Talos publishes the three-cluster report; CISA KEVs CVE-2026-20079Federal deadline September 12. Talos names UAT-12197, UAT-11823 (Sandworm-linked) and UAT-11988 (Qilin ransomware).
- Cisco ships a broader FMC hardening releaseBundles the two hotfixes plus other internally found issues Talos said it found during its own review.
Three attackers, same front door
| Cluster | CVE(s) used | Tooling | What they did |
|---|---|---|---|
| UAT-12197 | CVE-2026-20079 | JSP web shell ("home.jsp") + a JAR command executor ("cmd.jar") that shells out via /bin/sh -c | Queried FMC's internal database directly for usernames and auth_data — pure credential harvesting |
| UAT-11823 (assessed Sandworm, high confidence) | CVE-2026-20079 + CVE-2026-20316 | Malicious Makeself package disguised as a license file, triggering a root Netcat reverse shell; bash scripts to harvest managed-firewall configs; a Cyclops Blink variant | Exfiltrated configuration files from every firewall FMC manages, then planted a modular ELF implant previously tied to Russia's Sandworm group |
| UAT-11988 (assessed Qilin ransomware affiliate, high confidence) | CVE-2026-20316 | Living-off-the-land use of FMC's own package_info.pl utility, a Python SOCKS5 proxy, reverse-SSH tunnels over LDAP/Kerberos/SMB/NetBIOS/WinRM, Impacket and Invoke-TheHash | Logged in with the static credential, then harvested Active Directory and MySQL credentials, mapped domain controllers and Exchange servers, and staged loot in public FMC files for HTTP GET exfiltration — the on-ramp to a ransomware deployment |
How one front door led to three different back rooms
- CVE-2026-20079 auth bypass → root
- CVE-2026-20316 static credential login
- UAT-12197 web shell + JAR credential dump
- UAT-11823 (Sandworm-linked) reverse shell + config theft
- Cyclops Blink implant deployed
- UAT-11988 (Qilin affiliate) LOTL AD/MySQL recon + tunneling
- Qilin ransomware on staged endpoints
In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
What to actually check
- Apply the hotfixes for CVE-2026-20079 and CVE-2026-20316, or move to the September 16 hardening release — there is no workaround for either.
- Hunt for the published IOCs before you assume patching is enough: home.jsp, cmd.jar and a tampered license.tmp are the file-level markers Talos published for the web-shell and Sandworm-linked clusters.
- Check for unexpected outbound Netcat or SOCKS5 connections and reverse-SSH tunnels from the FMC host — the Qilin-linked cluster's tunneling relied on legitimate protocols (LDAP, Kerberos, SMB, WinRM) to blend in.
- Rotate every credential FMC had visibility into, not just its own admin accounts — the static-credential cluster was specifically after Active Directory and MySQL secrets reachable from the box.
- If you find any of the above, don't just reimage and move on — Cisco is asking affected customers to contact TAC, since this is now a documented multi-actor exploitation event, not a one-off.
Talos published the file names and behavioral indicators for all three clusters in its own report — use that as the ground truth rather than a third-party rule reconstruction.
CVE and KEV data current as of 2026-09-21live record →