Three distinct threat clusters compromised Cisco Secure Firewall Management Center (FMC) systems for different purposes: stealing credentials, collecting managed-device configurations, and preparing ransomware operations against selected endpoints. Cisco Talos’s September 9, 2026 report shows why defenders should treat FMC as a high-priority incident target: it is a management system whose compromise can expose sensitive access and configuration data. The observed intrusions do not prove that every compromised FMC gives an attacker control of every firewall it manages.
Why compromise of FMC matters
FMC is a management plane for a firewall estate, so an intrusion there can put information and access paths of wider operational value at risk. In the intrusions Talos documented, attackers queried FMC for authentication data and credentials, collected managed-device configurations, or used the system to support persistent access and ransomware activity. Those observations make FMC a consequential target even when an attacker’s actions do not demonstrate control of every managed firewall.
As an Amazon Associate I earn from qualifying purchases.
Talos described three clusters of post-compromise activity associated with state-sponsored and crimeware actors. The clusters had different observed methods and objectives; the report does not establish that they coordinated with one another.
Two vulnerabilities, different access paths
CVE-2026-20079: unauthenticated web-interface access
Cisco rates CVE-2026-20079 at CVSS 10.0. Talos describes it as an authentication bypass in the FMC web interface that an unauthenticated remote attacker can exploit to execute scripts and obtain root access. Cisco’s advisory says there is no workaround and recommends upgrading to a fixed release.
CVE-2026-20316: low-privilege remote login
CVE-2026-20316 is a separate vulnerability that allows remote login with a low-privilege account. Talos assigns it CVSS 5.3 and says it can be used with other FMC vulnerabilities to elevate privileges. Do not treat the lower score as evidence that the issue is irrelevant: it formed part of one cluster’s observed activity, and it is distinct from the unauthenticated bypass in CVE-2026-20079.
#1 Best Overall
![Cisco FPR1010-NGFW-K9 FirePower 1010 Next-Generation Firewall w/ AC Adapter [Unclaimed & No License] (Renewed)](https://m.media-amazon.com/images/I/210TbW+gN6L._SL160_.jpg)
- Firewall Protection Supported: Malware Protection
- Firewall Protection Supported: Threat Protection
- Firewall Protection Supported: URL Filtering
- Firewall Protection Supported: Intrusion Prevention
- Total Number of Ports: 8
How the three clusters differed
| Cluster | Observed access and techniques | Observed objective or outcome |
|---|---|---|
| UAT-12197 | Exploited CVE-2026-20079; placed a JSP web shell in the CSM Tomcat webroot; added a JAR command executor; queried internal databases. | Collected authentication data and credentials. Talos did not attribute this cluster in the report. |
| UAT-11823 | Exploited both CVEs; used a Netcat reverse shell; collected managed-device configurations; deployed a Cyclops Blink variant. | Espionage-like access and configuration collection. Talos assessed with high confidence that its tooling overlaps with Sandworm; this is a tooling-overlap assessment, not a categorical independent attribution. |
| UAT-11988 | Used static credentials, legitimate FMC tooling for reconnaissance, tunnels to maintain access, and credential collection. | Targeted selected endpoints. Talos assessed with high confidence that the cluster was a ransomware operator; subsequent activity was consistent with Qilin ransomware affiliates. |
The comparison matters for incident response: a search limited to one exploit signature could miss activity that began with credentials or used built-in management tools. The report documents distinct post-compromise paths, not a single shared playbook or motive.
Apply Cisco’s published fix for CVE-2026-20079
Cisco’s advisory, first published March 4, 2026 and updated September 16, 2026, lists these first fixed releases for CVE-2026-20079:
Rank #2
- Cisco asa 5525-x firewall edition - 8 port - gigabit Ethernet
- Cisco asa 5525-x firewall edition
- 8 port - gigabit Ethernet
| FMC release branch | First fixed release |
|---|---|
| 7.0 and earlier | 7.0.10 |
| 7.2 | 7.2.12 |
| 7.4 | 7.4.8 |
| 7.6 | 7.6.6 |
| 7.7 | 7.7.13 |
| 10.0 | 10.0.2 |
| 10.1 | 10.1.0 |
Cisco says these hardening releases include the CVE-2026-20079 fix and multiple other internally discovered vulnerabilities. Confirm the appropriate target release for your deployment against Cisco’s current advisory and Software Checker rather than inferring a version for a branch not listed here. The advisory states that Cisco deployed the fix to its hosted Security Cloud Control Firewall Management service, with no customer action required for that hosted fix.
Talos also recommends applying available hotfixes for both CVE-2026-20079 and CVE-2026-20316. A CVE-2026-20316-specific fixed-release table is not established here; check Cisco’s current advisory and Software Checker for applicable guidance on that vulnerability. Talos’s September 9 report described a comprehensive hardening release as upcoming for the week of September 14. Cisco’s September 16 advisory subsequently confirmed that hardening releases had been published for CVE-2026-20079, so the earlier scheduled date should not be used as current patch guidance.
Rank #3
- 10 × GbE (2 WAN, 2 PoE+), 1 × USB 2.0 for 3G/4G failover
- Stateful firewall throughput: 450 Mbps, VPN throughput: 200 Mbps
- Recommended maximum clients: 50, Layer 7 application visibility and traffic shaping
- Automatic firmware upgrades and security patches, VLAN support and DHCP services
- Includes 100W DC Power Supply, requires Enterprise or Advanced Security License
Check for possible exploitation and respond to suspicion
Cisco provides this check for possible exploitation of CVE-2026-20079. Run it in FMC expert mode:
zgrep "package_info.*license" /var/log/messages*Cisco says a matching log entry containing /var/tmp/license.tmp may indicate exploitation. It is an indicator to investigate, not a complete assurance that a system is clean when no match is found.
Rank #4
- REMOTE-WORKER READY: Pre-integrated support for additional Cisco Security capabilities, including Cisco AnyConnect remote access VPN and Cisco Duo multi-factor authentication.
- COMPACT: 1RU design for small and mid-sized offices
- PERFORMANCE WITHOUT SACRIFICE: Firepower 1000 Series firewalls include hardware-based acceleration, maintaining firewall performance in all conditions
- CONFIGURABLE: With available Firepower Threat Defense (FTD) base software, add network-based content inspection, Intrusion Prevention System (IPS), and URL filtering
- PEACE OF MIND: 90-day limited warranty
- Review the result. If the command returns a matching entry with
/var/tmp/license.tmp, treat it as a possible exploitation indicator and preserve the relevant logs and system information for investigation. - Contact Cisco TAC immediately if exploitation is suspected. Cisco specifically advises contacting TAC; patching alone should not be treated as recovery from an existing compromise.
- Apply the applicable fixes. Upgrade FMC to the appropriate fixed release for CVE-2026-20079 and apply available hotfixes for both CVEs. Cisco warns that hot fixes prevent future exploitation and may not address an existing compromise.
- Use detection coverage as an additional signal. Talos lists Snort SIDs 66075–66080 for CVE-2026-20079, SID 66883 for CVE-2026-20316, and SIDs 66960–66961 for the malware. These detections complement, rather than replace, host investigation and vendor guidance.
Reduce exposure without mistaking it for a fix
Cisco notes that if the FMC management interface does not have public internet access, the attack surface associated with CVE-2026-20079 is reduced. Restricting exposure is worthwhile, but it does not replace upgrading to a fixed release, and it does not establish that an already-exposed system was not compromised. Treat management-interface reachability as a risk-reduction measure alongside patching and investigation.
Quick Recap
Best Value
- More Secured Server Mounting Setup: RM-CI-T14 by Rackmount.IT IU rack mount kits have dedicated slots to safely install compatible Cisco Meraki models, including Cisco Meraki MX68, MX68W, MX68CW, and MX75.
- Improves Cable Management: All console ports of the Cisco Meraki appliance are brought to the front for easy access and user convenience — all while preventing overheating with custom-made cut-outs.
- Straightforward Installation Process: Mounting your appliance to a 19 inch shelf only takes 2-5 mins. as our network tray kits have everything a user needs — bolts, hex keys, zip ties, port labels, cables, and an assembly guide.
- Suitable for Any Type of Business: Our 1U rack shelf kits are designed to fit your appliance in 19-inch network rack shelves, making them ideal for small business owners, large corporations, and government agencies looking to improve their cloud management and network connectivity.
- Passionate for Smart Design and Customization: Rackmount.IT offers innovative solutions to common user needs by producing high-quality custom rack mounted shelf with excellent features that support major desktop appliance manufacturers.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
