Cisco Firewall Manager Sandworm breach Cisco Talos disclosed on September 9, 2026, that three separate attacker clusters are actively exploiting Cisco Secure Firewall Management Center (FMC) software, with one cluster tied to the Russian GRU unit Sandworm and another assessed with high confidence as a Qilin ransomware affiliate. The disclosure, which centers on the Cisco Firewall Manager Sandworm breach, also includes a third intelligence-collection cluster Talos tracks as UAT-12197. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and set September 12 as the mandatory patch deadline for federal civilian agencies.
Cisco Firewall Manager Sandworm breach built on two chained flaws
The exploitation campaign targets the on-premises version of Cisco Secure FMC Software. Neither the cloud-delivered FMC, Cisco ASA Software, Firewall Threat Defense Software, nor Security Cloud Control is affected, according to Cisco’s advisory. The first and more severe flaw, CVE-2026-20079, carries a CVSS score of 10.0, the maximum on the standard severity scale, and is classified under CWE-288, an authentication bypass using an alternate path. An attacker needs no password and no prior foothold: a crafted HTTP request to the FMC web management interface is enough to bypass authentication entirely and execute scripts with root privileges.
Cisco first disclosed the flaw on March 4, 2026, and patches were available at that time. The advisory confirms August 2026 exploitation, with indicators of compromise suggesting activity dates to at least July 23, 2026. The second flaw, CVE-2026-20316, has a CVSS score of 5.3 but a High Security Impact Rating from Cisco. It is classified as CWE-259, with hard-coded login credentials for a low-privileged account baked directly into the FMC web interface. CISA added CVE-2026-20316 to its KEV catalog on July 29, 2026, weeks before CVE-2026-20079 joined the same list. This is FMC’s third KEV entry in 2026.
Cisco Firewall Manager Sandworm breach opens every firewall policy in the enterprise
Cisco FMC is the administrative authority for every Cisco Secure Firewall device it manages, holding every policy, every credential, and every configuration across an organization’s firewall fleet. One breached FMC means the attacker can see through the eyes of an entire perimeter, not just one compromised device. That is why attackers from three different clusters with three different objectives converged on the same platform.
The first cluster, UAT-12197, focused on credential theft. After exploiting CVE-2026-20079, it placed a JSP-based web shell in the Cisco Security Manager Tomcat webroot directory, dynamically loading Java classes by Base64-decoding a parameter value. It then dropped a command-execution JAR file, cmd.jar, and used it to run a query against FMC’s internal database extracting the authentication data for every account on the compromised instance. Those credentials become entry points into every downstream network and device the FMC manages.
Cisco Firewall Manager Sandworm breach deploys Cyclops Blink on management plane
The second cluster, UAT-11823, is attributed with high confidence to Sandworm, the Russian military intelligence unit formally identified as GRU Unit 74455 and previously attributed by U.S. and UK agencies to NotPetya, the 2015 and 2016 attacks on Ukrainian electricity infrastructure, and the 2018 Winter Olympics cyberattacks. UAT-11823 used both CVE-2026-20079 and CVE-2026-20316 to gain access, then replaced the license.tmp file with a Makeself self-extracting archive and triggered its execution by invoking package_info.pl, a legitimate Cisco license-management utility, with the –lsm argument. The result was a Netcat-based reverse shell connecting back to command-and-control infrastructure, a textbook living-off-the-land technique.
The group also deployed bash scripts that harvested the full configurations of all firewall devices managed by the compromised FMC, packaging the data into archives staged for later exfiltration. The final payload was Cyclops Blink, a modular ELF implant previously attributed to Sandworm by the NSA, CISA, the FBI, and the UK’s NCSC following a 2022 campaign against WatchGuard Firebox and ASUS routers. The 2026 FMC variant carries the same signature hash as samples previously documented. Its capabilities include persistence scripts registered in /etc/init.d/, DNS-over-HTTPS for command-and-control IP resolution, file upload and download, credential harvesting, arbitrary command execution, network scanning and discovery, and packet sniffing with configurable filters. An implant with packet-sniffing capability on an FMC instance is an implant watching everything the firewalls it manages are designed to examine.
Cisco Firewall Manager Sandworm breach shows ransomware pivoting to security infrastructure
The third cluster, UAT-11988, is assessed with high confidence to be an affiliate of Qilin, the Russian-language ransomware-as-a-service operation that ranked as the most prolific ransomware collective globally for four consecutive quarters through Q2 2026, with at least 557 separate incidents documented from January through May 2026. UAT-11988 gained initial access using the static credentials associated with CVE-2026-20316 and then used the same package_info.pl technique as UAT-11823 to achieve root execution.
What followed was methodical reconnaissance that mapped everything: host names, IP addresses, and directory structures; Active Directory service-account credentials and MySQL account credentials; domain account information; and full computer object lists spanning domain controllers, ADFS servers, Exchange servers, file servers, and database servers. All collected data was exfiltrated via HTTP GET requests leveraging the FMC’s existing outbound web connectivity. UAT-11988 then established persistent access using a Python SOCKS5 proxy and a reverse-SSH tunnel from the FMC back to attacker infrastructure, forwarding LDAP (389), LDAPS (636), Kerberos (88), SMB (445), NetBIOS (135), and WinRM (5985). That port list is a functional tunnel into the organization’s entire Active Directory environment. The pre-ransomware phase deployed Impacket and Invoke-TheHash, custom antivirus-killer payloads, and finally Qilin ransomware against a carefully pre-assembled list of target endpoints. Qilin’s 2026 victims have included Covenant Health, the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosiles, and Doctor.com.
Cisco Firewall Manager Sandworm breach requires immediate patching and compromise checks
Cisco has released hotfixes for affected versions (7.0, 7.2, 7.4, 7.6, 7.7, and 10.0) and is urging customers to apply them immediately without waiting for the comprehensive hardening release expected the week of September 14, 2026. Cisco confirmed no workaround exists for CVE-2026-20079; restriction of management interface access to trusted networks reduces the attack surface but does not close the vulnerability. Talos published Snort SIDs 66075 through 66080 for CVE-2026-20079, Snort SID 66883 for CVE-2026-20316, and Snort SIDs 66960 and 66961 covering the associated malware families.
Administrators who cannot immediately patch should audit for unexpected files in Tomcat webroot directories, any logs containing references to /var/tmp/license.tmp, unusual outbound connections from the FMC management appliance, and any use of package_info.pl with non-standard arguments. Cisco’s advisory notes that a log entry referencing /var/tmp/license.tmp may indicate the vulnerability has already been exploited. Any organization that finds that indicator should treat the FMC as fully compromised before trusting any policy it currently manages and contact Cisco TAC for support. Cisco Firewall Manager Sandworm breach.
What to watch: with CISA’s September 12 federal deadline now active, expect private-sector patch cycles, indicator-of-compromise sweeps, and potential follow-on disclosures from Talos as the hardening release lands the week of September 14. The convergence of Sandworm espionage tooling and Qilin ransomware tradecraft on a single management platform suggests security management consoles will remain a high-value target category through the rest of 2026, and any organization running an unpatched on-premises Cisco Secure FMC with a management interface reachable from untrusted networks remains a live target in the ongoing Cisco Firewall Manager Sandworm breach.