FlawOpen

flawopen.com/Incidents/cisco-fmc-auth-bypass-qilin-sandworm-intrusions-september-2026

● Cisco Secure Firewall Management Center · CVE-2026-20079 · 2026-09-09 · CVSS 10.0 · Editorial severity: Critical
FlawOpen Security Research

Cisco FMC Attacks: Auth Bypass, Sandworm, and Qilin

Cisco Talos documented three distinct intrusion clusters targeting Cisco Secure Firewall Management Center (FMC). The activity involved a CVSS 10.0 authentication bypass, a separate static-credential flaw, and post-compromise paths ranging from credential theft to Cyclops Blink and Qilin ransomware.[1], [2], [3]

💡 Plain English Explainer (ELI5)

A firewall manager is the control room for many network doors. If an intruder takes the control room, they can steal its keys, change how the doors are watched, or use it as a hidden route into the building. Talos saw three groups use compromised FMC systems differently, so patching the manager and investigating what happened are both necessary.[1]

Core Concepts & Subsystem Terms

Management plane
The FMC interface and services used to administer firewall devices. A compromise can expose credentials and provide a pivot into managed networks.[1], [2]
CVE-2026-20079 (CWE-288)
Cisco classifies this as a CVSS 10.0 authentication bypass. Its advisory says an improper boot-time system process can let a remote unauthenticated attacker execute scripts and obtain root access.[2]
CVE-2026-20316 (CWE-259)
A separate CVSS 5.3 static-credential flaw permits login as a low-privileged account. Cisco says it can be combined with other FMC flaws to elevate impact; it is not the same flaw as CVE-2026-20079.[3]
Intrusion cluster
A tracked set of related post-compromise behaviors. Talos separated three clusters; their access methods and outcomes should not be collapsed into one universal chain.[1]
Incident-level impact rating
FlawOpen's editorial rating is Critical because Cisco rates CVE-2026-20079 CVSS 10.0 and Talos documents post-compromise paths ending in Cyclops Blink or Qilin ransomware. This incident-level rating does not mean CVE-2026-20316 itself is Critical; Cisco rates that separate flaw CVSS 5.3.[2], [1], [3]

Framework mappings

Incident Timeline

2026-03-04

Cisco publicly disclosed CVE-2026-20079; CVE-2026-20316 was disclosed July 29.[2], [3]

2026-07 to 2026-08

Cisco later said PSIRT became aware of active exploitation of CVE-2026-20316 in July and CVE-2026-20079 in August.[2], [3]

2026-09-09

Talos described three clusters and their different post-compromise activity.[1]

2026-09-16

Cisco published hardening releases that include fixes for both CVEs and additional internally discovered vulnerabilities.[4], [2], [3]

Step-by-Step Attack Flow

Step 1

Two distinct access flaws

CVE-2026-20079 is an unauthenticated web-interface authentication bypass leading to root-level script execution. CVE-2026-20316 is a static credential for a low-privileged account. They are related in some intrusions, but do not treat them as one vulnerability.[2], [3]

Step 2

Talos tracked three different clusters

UAT-12197 used CVE-2026-20079 and deployed a web shell and JAR-based command executor to obtain credentials. UAT-11823 used both CVEs, then deployed proxy/reverse-shell tooling and a Cyclops Blink variant; Talos reports tooling overlap with Sandworm.[1], [2], [3]

Step 3

Qilin activity followed a separate path

Talos says UAT-11988 logged in with the static credential flaw, performed reconnaissance and credential theft, established tunnels, and deployed Qilin ransomware on selected endpoints. Talos assesses with high confidence that this cluster was a ransomware operator.[1], [3]

Step 4

Patch and investigate separately

Cisco’s log guidance can identify a sign that exploitation may have occurred. A hotfix or hardening release blocks future exploitation, but Cisco warns it may not remediate an existing compromise; contact TAC when the indicator is present.[2], [3], [4]

Source Code: Flaw vs. Secure Implementation

This small Python example is an illustrative authorization boundary, not Cisco FMC source or a reconstruction of either CVE. The vulnerable form dispatches a privileged action without checking identity or permission; the hardened form requires both authentication and explicit management authorization. Cisco describes CVE-2026-20079 only as an improper boot-time system process and does not publish the affected implementation or patch diff. The example therefore teaches the control boundary without claiming to reproduce Cisco code.[2], [3]

UNPATCHED FLAW
def invoke_management_action(identity, action):
    return action.execute()
HARDENED SECURE PATCH
def invoke_management_action(identity, action):
    if identity is None:
        raise PermissionError('authentication required')
    if not identity.can_manage_firewall:
        raise PermissionError('management authorization required')
    return action.execute()

Engineering & System Hardening Checklist

Sources