Cisco FMC is under active root-level exploitation. The hotfix does not clean a box that already ran license.tmp.

Talos published three post-compromise clusters on CVE-2026-20079 the same day CISA KEV’d it. Federal due date is 12 September. Patching without forensic triage is not remediation.

RWP Ventures · 2026-09-10 · event 2026-09-09 · 13 min read · priority 8.9

The same day, Cisco Talos published three post-compromise clusters on FMC. One deployed webshells and dumped FMC user credentials. One, which Talos attributes with high confidence to an APT cluster overlapping Sandworm tooling, dropped a Cyclops Blink variant. One, which Talos attributes with high confidence to a Qilin ransomware operator, used the sibling static-credential bug CVE-2026-20316 as the foothold, then tunneled LDAP/Kerberos/SMB/WinRM off the management plane and encrypted.

FMC is not a firewall. It is the box that writes policy to the firewalls. An unauthenticated root on FMC is an unauthenticated root on the management plane of the estate. The July/August hotfixes stop the next request. They do not undo package_info.pl /var/tmp/license.tmp. Hunt first if that line is in /var/log/messages*. Then patch. Then assume credentials and managed-device configs walked.

What happened

Cisco first disclosed CVE-2026-20079 on 4 March 2026 as part of the semiannual Secure Firewall bundled publication. The vendor description has not moved: an improper system process created at boot time lets an unauthenticated remote attacker send crafted HTTP requests to the FMC web interface, bypass authentication, and execute scripts as root. The note that still matters operationally: if the FMC management interface is not on the public internet, the attack surface shrinks. It does not go to zero on a routed management VLAN.

On 29 July, Cisco disclosed CVE-2026-20316 (cisco-sa-fmc-static-cred-BET3Cjh): static credentials for a low-privileged web account, CVSS 5.3, SIR High because it chains. PSIRT said it became aware of 20316 exploitation in July. The two advisories share the same forensic indicator and the same hotfix files. Cisco did not, in July, confirm 20079 exploitation. Version 2.5 of the 20079 advisory, published 9 September, does: “In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.”

CISA’s 9 September KEV alert added four CVEs:

Talos’s 9 September write-up is the technical increment, not the KEV listing. Three clusters:

UAT-12197. Exploitation of CVE-2026-20079. JSP webshell in the CSM Tomcat webroot (home.jsp), then a JAR command executor (cmd.jar) used to query the FMC database: OmniQuery.pl -db mdb -e 'SELECT name, auth_data FROM users;'. Credential theft from the management plane.

UAT-11823. Talos: high-confidence APT, tooling overlap with Sandworm. Initial access via CVE-2026-20079 and/or CVE-2026-20316. Makeself-wrapped malicious license.tmp executed through package_info.pl as root, Netcat reverse shell, managed-device configuration harvest, then a modular ELF implant Talos identifies as Cyclops Blink (DoH resolution, file admin, credential harvest, scanning, packet sniffing, /etc/init.d/ persistence). The United States and United Kingdom have previously attributed Cyclops Blink to Sandworm. That prior attribution is not, by itself, a Talos statement that this cluster is Sandworm. It is overlap.

UAT-11988. Talos: high-confidence ransomware operator. Static credentials (CVE-2026-20316), then living-off-the-land via package_info.pl. Recon of hostnames, AD service accounts, MySQL, computer objects, DC/ADFS/Exchange/file/database mappings. SOCKS5 plus reverse-SSH forwarding of LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM. Impacket, Invoke-TheHash, AV killers, then Qilin on selected endpoints. Subsequent TTPs “consistent with those of Qilin ransomware affiliates.”

Cisco’s cloud-delivered Security Cloud Control Firewall Management was patched by Cisco. No customer action on that SaaS path. On-prem FMC is the problem. Not affected, per Cisco: Firewall Device Manager, ASA Software, FTD Software, and Security Cloud Control (formerly Defense Orchestrator). The devices FMC manages are not the CVE. They are the blast radius if the manager is owned.

Why it matters

Three facts should not be collapsed.

First: this is unauthenticated, remote, root, on the manager. Yesterday’s Daily Top was two local Windows EoPs that CISA KEV’d without a forensic-triage flag. Those are post-phish ladders. CVE-2026-20079 is a front door. BOD 26-04’s three-day clock and the forensic-triage bit are CISA saying the asset class grants total control post-exploitation on a publicly exposed surface. Treat that literally.

Second: the hotfix is prevention, not eradication. Cisco’s own IoC language: if zgrep "package_info.license" /var/log/messages shows COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm, the vulnerability may have been exploited. Contact TAC. The hotfixes “are for preventing future exploitation only and may not address existing compromise.” Installing GB/HL/HG/CY/AM/P and declaring the ticket closed is how you leave a Cyclops Blink implant or a SOCKS tunnel on the box that still has AD hashes.

Third: Talos’s three clusters are not one campaign. Webshell-and-dump, Sandworm-overlap APT, and Qilin can all use the same two CVEs without sharing operators. That is the edge-device pattern of 2024–2026, now on the manager rather than the sensor. A single internet-facing FMC is a shared primitive.

For industrial operators: there is no confirmed OT or physical-process impact in Cisco’s advisory or Talos’s clusters. FMC is an IT management plane. Firewalls it manages often sit on IT/OT conduits. A compromised FMC can push policy, harvest credentials, and tunnel. That is IT compromise adjacent to OT. Do not write it up as a PLC event. Do inventory whether the OT boundary firewalls are FMC-managed, and whether that FMC’s management interface was reachable from anywhere it should not have been.

Who / what is affected

Technical context

RWP is not reproducing the HTTP request shape, the boot-time process, or a Makeself recipe. Cisco’s public description is enough: crafted HTTP to the web interface, authentication bypass, script execution as root, CWE-288. The shared post-exploit tell is abuse of a legitimate installer helper — package_info.pl — against an attacker-dropped /var/tmp/license.tmp. That is living-off-the-land on the appliance, not a novel implant in the first stage.

ATT&CK mapping for what Talos observed, not a hypothetical:

• Initial access: exploit public-facing application (T1190)
• Persistence: webshell (T1505.003); /etc/init.d/ for the Cyclops Blink variant (T1037)
• Credential access: OS credential dumping / query of the FMC user table (T1003 / T1552)
• Command and control: Netcat reverse shell; DoH in the Cyclops Blink variant (T1572)
• Lateral movement / tunneling: protocol tunneling, proxy, reverse SSH of 389/636/88/445/135/5985 (T1572 / T1090)
• Impact (UAT-11988 only): data encrypted for impact (T1486) — Qilin, after the FMC foothold, not by the CVE itself

CVE-2026-20316 is a hard-coded password (CWE-259). Alone it is a low-priv login. Talos’s Qilin cluster used it that way. Do not score it as “only 5.3” in isolation from 20079; Cisco already raised the SIR because of the chain.

Threat / exploitation status

High confidence on: vendor confirmation of 20079 exploitation, KEV listing, due date, forensic-triage flag, hotfix filenames, the IoC string, and Talos’s description of the three clusters as observed. Moderate confidence on actor identity beyond Talos’s own cluster names. Low confidence on population exposed and on whether CISA will flip the ransomware-use flag.

What defenders should do

1. Find every on-prem FMC. Management IP, version (7.0 / 7.2 / 7.4 / 7.6 / 7.7 / 10.0), whether the web interface answers from anywhere it should not. Cloud SCC Firewall Management is Cisco’s problem and is already patched.
2. Hunt before you call the hotfix a close. In expert mode: zgrep "package_info.license" /var/log/messages. If you see /var/tmp/license.tmp, treat the appliance as compromised, contact Cisco TAC, and do not assume the hotfix is remediation. Look for unexpected JSP in the CSM Tomcat webroot, cmd.jar, Makeself license.tmp, Netcat outbound, /etc/init.d/ persistence, SOCKS/reverse-SSH, and the hashes/IPs in Talos’s September 2026 IOC set. Snort SIDs 66075–66080 (20079), 66883 (20316), 66960–66961 (malware).
3. Apply the branch-matched hotfix, then rotate. Cisco Software Center:

| FMC release | Hotfix |

|---|---|

| 7.0 | Cisco_Firepower_Mgmt_Center_Hotfix_GB-7.0.9.1-3.sh.REL.tar |

| 7.2 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HL-7.2.11.1-4.sh.REL.tar |

| 7.4 | Cisco_Secure_FW_Mgmt_Center_Hotfix_HG-7.4.7.1-3.sh.REL.tar |

| 7.6 | Cisco_Secure_FW_Mgmt_Center_Hotfix_CY-7.6.5.1-2.sh.REL.tar |

| 7.7 | Cisco_Secure_FW_Mgmt_Center_Hotfix_AM-7.7.12.1-2.sh.REL.tar |

| 10.0 | Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar |

Same files cover CVE-2026-20316. No additional 20316 patch. There are no workarounds. Talos says a broader hardening release is due the week of 16 September; do not wait for it if you are unpatched today.

1. If IoCs hit, rotate what FMC could touch: FMC local users, any directory integration, API tokens, and credentials stored for managed devices. Re-issue firewall admin sessions. Inspect policy change history and deployment jobs for a window starting no later than the July IoC date Cisco printed (23 July 2026) unless your own logs bound it tighter.
2. Same 72-hour KEV window, different products. NetScaler CVE-2026-19490: builds 14.1-73.32 and 13.1-63.21 (CTX696939); later trains need a SAML action on Gateway/AAA to be in scope — verify the config string add authentication samlAction. Fortinet CVE-2025-25249: FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18 or migrate off 6.4; FortiSwitchManager 7.2.7 / 7.0.6; workaround is removing fabric from allowaccess on each interface (FG-IR-25-084). Both carry forensic-triage flags. Chrome CVE-2026-87491 is a 23 September problem: Chrome 153.0.8010.36/.37, and restart the browser.
3. Yesterday’s Windows KEVs are not cancelled. CVE-2026-81963 and CVE-2026-85880 remain Exploitation Detected. Sequence: internet-facing FMC / NetScaler / FortiGate / Magento / N-central if you still have them, then the September Windows cumulatives, then the rest of Patch Tuesday by reachability.

This is not an exploitation guide. Use Cisco PSIRT, Talos, and CISA KEV.

RWP assessment

Score 8.9. Unauthenticated root on the firewall manager, vendor-confirmed exploitation, same-day CISA KEV with a three-day clock and forensic triage, and three Talos clusters that include Sandworm-overlap malware and a Qilin operator. That outranks the rest of the 9 September KEV batch and outranks the BlueMoon Chrome/Windows chain as today’s decision.

BlueMoon (Proofpoint, Volexity, 9 September) is a material development on [yesterday’s Patch Tuesday assessment](/posts/2026-09-09-microsoft-patch-tuesday-windows-eop-zero-days/). Four espionage clusters, most China-aligned, chained CVE-2026-85046 (V8 type confusion, patched in Chrome 3 September) with CVE-2026-87491 (V8 sandbox escape, Chrome 153) and CVE-2026-85880 (Windows ALPC EoP, September cumulatives). Identical shellcode across actors. Patch-gap on Chromium source versus stable. Payloads differed: GRIMWEDGE, LONGTALE, ShadowPad. Proofpoint observed fewer than 20 organizations in the clusters it published and said the true number is almost certainly higher. It is a hunt-and-patch-browser story with a 23 September Chrome KEV date. It is not a three-day forensic-triage on the box that deploys firewall policy. It lost on urgency and on blast radius, not on evidence quality.

Fortinet PivotC2 (SOCRadar, 8 September; KEV 9 September) is a real edge-RCE campaign — 178 infections, U.S.-heavy, Russian-speaking crime ASSESSED — against a January patch. NetScaler 19490 is KEV with a public PoC and attempt telemetry from 3 September; we already flagged it as KEV-speed in the 7 September weekly. Neither equals Talos naming Cyclops Blink and Qilin on FMC on the same day CISA started the 72-hour clock.

What we are watching

• Whether CISA flips CVE-2026-20079’s ransomware-use flag after Talos’s Qilin cluster.
• Talos’s hardening release, week of 16 September, and whether it is required on top of the current hotfixes.
• Additional FMC clusters beyond the three named. The primitive is public.
• BlueMoon: whether financially motivated actors pick up the kit as Chrome 153 and the September Windows cumulatives finish rolling; whether Windows 11 22H2+ stays out of the LPE gate (build > 22000 rejected in the kit Proofpoint and Volexity analyzed).
• NetScaler 19490 and Fortinet 25249 due 12 September: victim reports, not just scans.
• Magento StyleSmuggler and N-central CVE-2026-86218: federal due 11 September; still open if those estates were not triaged.

Sources

• Cisco — CVE-2026-20079 Secure FMC authentication bypass (v2.5, 9 Sep)
• Cisco — CVE-2026-20316 Secure FMC static credential
• Cisco Talos — Active exploitation of Cisco Secure FMC vulnerabilities
• Cisco Talos — September 2026 IOCs
• CISA — four KEV additions, 9 September 2026
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — Cisco confirms CVE-2026-20079 exploited
• Proofpoint — Once in a BlueMoon
• Volexity — Mind the (Patch) Gap
• Google — Chrome 153 stable (CVE-2026-87491)
• Fortinet FG-IR-25-084 / CVE-2025-25249
• SOCRadar — PivotC2 / CVE-2025-25249
• Citrix CTX696939 — NetScaler CVE-2026-19490
• [RWP Daily Top, 9 September 2026 — Microsoft Patch Tuesday Windows EoP zero-days](/posts/2026-09-09-microsoft-patch-tuesday-windows-eop-zero-days/)