FMC Root Bypass CVE-2026-20079 Enabled Three Clusters to Harvest Credentials and Deploy Qilin via LOTL
Three threat clusters exploited Cisco FMC authentication bypass and information disclosure flaws to obtain root access, harvest credentials, and deploy Qilin ransomware using living-off-the-land techniques. Evidence links one cluster to a Sandworm-linked Cyclops Blink variant while CISA mandated federal patching. The convergence of state and crimeware actors on the same management interface highlights persistent segmentation failures in security tooling.
The two flaws, CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 (CVSS 5.3), permitted initial access followed by privilege escalation and script execution on the underlying OS. Cisco Talos observed UAT-12197 dropping JSP web shells and JAR executors to query internal databases, UAT-11823 deploying Netcat shells plus a Cyclops Blink variant, and UAT-11988 using built-in FMC tools for reconnaissance, tunneling, credential collection, and Qilin deployment on targeted endpoints. CISA added both CVEs to the KEV catalog with September 2026 deadlines for federal agencies. Procurement records and prior Sandworm tooling show consistent reuse of modular ELF implants across state and ransomware operations, indicating shared infrastructure or code leakage rather than independent development. Cisco's plan for a single hardening release next week addresses internally found issues but leaves current hotfixes as the only immediate control; managed-device configurations harvested by the actors reveal exposure of downstream firewalls still running unpatched code. Independent verification of Cyclops Blink attribution remains limited to behavioral matches; no new infrastructure ties were published. The pattern of multiple clusters converging on the same management plane underscores that centralized firewall consoles remain high-value targets when authentication boundaries can be bypassed outright. Next steps include mandatory KEV remediation by September 12 for FCEB agencies and monitoring for renewed access attempts once the comprehensive hardening package ships. Unpatched instances will continue to serve as credential sources for both state and ransomware actors.
Cisco: Comprehensive hardening release ships within 10 days but leaves residual exposure on managed devices until full upgrade cycle completes.
Sources (3)
- [1]Cisco Talos Threat Intelligence(https://blog.talosintelligence.com/cisco-fmc-exploits/)
- [2]CISA Known Exploited Vulnerabilities Catalog(https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [3]Cisco Security Advisory(https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-auth-bypass)