Three distinct threat actor clusters are actively exploiting a critical authentication bypass in the Cisco Secure Firewall Management Center (FMC), identified as CVE-2026-20079. Cisco Talos reports that UAT-12197 is deploying web shells and a specific JAR file, cmd.jar, to facilitate credential theft via OmniQuery. Simultaneously, UAT-11823—linked to the Russian APT Sandworm (GRU Unit 74455)—is deploying Cyclops Blink malware. A third group, UAT-11988, associated with Qilin ransomware, is leveraging this vulnerability alongside CVE-2026-20316 for reconnaissance and credential harvesting. Notably, this same Qilin group has been observed targeting Check Point VPN gateways, demonstrating a calculated strategy to compromise both edge infrastructure and internal management planes.
The vulnerability carries a CVSS score of 10.0 and allows remote, unauthenticated attackers to execute scripts as root. According to the Cisco advisory, the root cause is an “improper system process that is created at boot time.” An attacker exploits this by sending crafted HTTP requests to an affected device. This flaw was identified by Brandon Sakai of Cisco during internal testing and has been added to the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of September 12, 2026. SecurityWeek reported that Cisco updated its advisory on September 9 to reflect active exploitation.
The attack chain follows a consistent pattern. Upon bypassing authentication, the attacker gains root access to the FMC. They deploy a JSP web shell into the CSM Tomcat webroot. The attacker then executes the cmd.jar file to run the command: /var/jre/bin/java -jar cmd.jar ‘/var/sf/bin/OmniQuery.pl -db mdb -e “SELECT name, auth_data FROM users;”‘. This sequence directly exfiltrates user credentials from the database.
This exploitation of the management plane represents the latest iteration of the authentication gap. The arc has progressed through middleware, N-able remote monitoring, identity providers, endpoint management, ERP systems, and VPN infrastructure. The management plane is the central console for configuring firewalls, VPN policies, and network access rules. By compromising this layer, attackers gain control over the entire environment managed by the FMC.
This is the third FMC vulnerability added to the CISA KEV catalog in 2026, following CVE-2026-20316 and CVE-2026-20131. The persistent targeting of this management layer indicates a calculated shift in adversary focus toward centralized control points.
There are no workarounds for CVE-2026-20079. Organizations must apply the provided hotfixes for affected versions: 7.0.9, 7.2.11, 7.4.6, 7.6.5, 7.7.12, and 10.0.1. Affected versions range from 6.4.0.13 through 10.0.1, though SaaS SCC instances are already patched.
Practitioners should prioritize hunting for indicators of compromise. Specifically, check for the presence of /var/tmp/license.tmp in package_info logs. Additionally, implement Snort rules 66075-66080 to detect related traffic. Given the active exploitation by state-sponsored and ransomware actors, immediate patching is required to secure the management plane.