Three Groups in One Firewall Manager

Cisco Talos published details on 9 September of ongoing exploitation of Cisco Secure Firewall Management Center. The primary vulnerability, CVE-2026-20079, is a CVSS 10.0 authentication bypass that lets an unauthenticated remote attacker execute scripts and obtain root on the management appliance; CVE-2026-20316, at 5.3, allows login with low-privileged accounts and can be chained for escalation. Talos describes three distinct clusters. UAT-12197 exploited CVE-2026-20079 to deploy JSP web shells and a JAR-based command executor and exfiltrated user credentials from internal databases. UAT-11823 is an APT actor whose tooling overlaps with Sandworm; it used both vulnerabilities to establish Netcat reverse shells and deployed Cyclops Blink, malware previously attributed to that group, with capabilities including DNS-over-HTTPS resolution and credential harvesting. UAT-11988 is a ransomware operator that used CVE-2026-20316 credentials for reconnaissance, persisted through SOCKS proxies and reverse SSH tunnels, and deployed Qilin. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on 9 September with a federal remediation deadline of 12 September. Cisco advises immediate application of the available hotfixes, with a comprehensive hardening release due the week of 14 September.

Three unrelated actors on one vulnerability is the detail that should change how this is prioritised. It means the exploit is not held closely — it is in general circulation, being used by a state-aligned group, a credential thief and a ransomware crew simultaneously. The practical implication is that the window between disclosure and mass exploitation has already closed, and any unpatched appliance should be treated as potentially compromised rather than merely at risk.

What makes the target choice worth understanding is that a firewall management centre is not a firewall. It is the system that holds the policy for every firewall it manages, along with the credentials to push configuration to them. Root on that appliance means the ability to read the entire network's segmentation policy — which for an industrial operator is a map of exactly which paths exist between the business network and the plant — and the ability to change it. The presence of Cyclops Blink, which historically targeted network devices for persistence, suggests at least one actor's objective was long-term access rather than immediate disruption.

For anyone running FMC, the sequence is patch, then hunt, and the second part is not optional here. Apply the hotfixes for both CVEs now rather than waiting for the consolidated hardening release. Then look for the specific artefacts Talos describes — JSP web shells in the appliance's web directories, unexpected JAR files, Netcat processes, SOCKS proxies and reverse SSH tunnels — and rotate every credential the appliance held, including the accounts it uses to manage downstream firewalls, because credential exfiltration was the common goal across two of the three clusters. And review the firewall policy itself for changes: an attacker with root on the management plane can add a rule that survives the patch.