Cisco Confirms Sandworm and Qilin Both Hit Its Firewall Software

An unauthenticated attacker who can reach the web interface of an unpatched Cisco Secure Firewall Management Center needs nothing else to obtain root access to the underlying operating system. Cisco's own advisory for CVE-2026-20079, first published March 4 and last updated Sept. 16, rates the flaw 10.0 out of 10 on the CVSS scale, its maximum score. Cisco Talos said in a report that at least three separate groups exploited it, including one it links to the Russian state hacking group Sandworm and one to a Qilin ransomware affiliate.

The bug sits in a system process that Cisco Secure FMC creates at boot. If no administrator logs in after startup, a partial session persists in the product's own session database and can be upgraded into working credentials, according to Cisco's advisory. All on-premises FMC releases from 7.0 through 10.1 are affected; Cisco's cloud-delivered FMC is not. Cisco said it has no workaround and that fixes are available in versions 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0.

Three crews, one root shell

Talos tracks the intrusions as three distinct clusters. UAT-12197 deployed JSP-based web shells and a JAR command executor to run database queries pulling usernames and credential hashes directly from FMC's user tables, Talos said. UAT-11823, which Talos assessed with high confidence as Sandworm, opened netcat reverse shells and installed Cyclops Blink, malware with its own persistence, DNS-over-HTTPS command channel and network-scanning functions, then harvested configuration files from every firewall the compromised FMC managed. UAT-11988, assessed with high confidence as a Qilin ransomware affiliate, got in through a separate, lower-severity static-credentials bug, CVE-2026-20316, then used FMC's own package_info.pl utility to pull Active Directory and database credentials before deploying antivirus-killing tools and Qilin ransomware itself.

Cluster	Talos attribution	What it did
UAT-12197	Unattributed	Web shells and a SQL query for credential hashes
UAT-11823	Sandworm (high confidence)	Cyclops Blink malware, config exfiltration
UAT-11988	Qilin ransomware affiliate (high confidence)	AD credential theft, then Qilin ransomware

A three-day patch window, again

CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog on Sept. 9 and set a due date of Sept. 12 for federal civilian agencies, a three-day remediation window under Binding Operational Directive 26-04. Cisco's advisory said its Product Security Incident Response Team first became aware of active exploitation in August, a full five months after the flaw was originally disclosed with no evidence of exploitation in March. The gap between disclosure and exploitation is the same pattern this desk flagged in CISA's addition of two MikroTik RouterOS flaws earlier this month, where the catalog entry and the vendor's own advisory covered different halves of a single attack chain.

What operators can still check

BleepingComputer reported that Cisco's indicators of compromise point administrators to /var/log/messages for entries referencing /var/tmp/license.tmp, generated when the package_info.pl utility is invoked outside of normal licensing checks. Because Cisco has published no workaround, the only remediation is installing a fixed release or hotfix. Whether the same three clusters retain access to devices patched after initial compromise is a question Cisco's advisory does not address, and it is the same gap this desk found in September's Patch Tuesday zero-days: a fixed version number is not the same claim as a cleaned network.