CVE-2026-20079: Cisco FMC Pre-Auth Root RCE Exploited by Sandworm and Qilin Ransomware

CVE-2026-20079 exploits a design flaw in how Cisco FMC handles its internal session lifecycle during boot. When the FMC starts, it creates a background session with the identifier csm_processes in its session database. This session uses a static, predictable ID instead of a randomly generated UUID. It persists in the database until an authenticated administrator interacts with the FMC web interface, at which point the dashboard clears it.

Before any administrator login occurs, an attacker can present this known session cookie value (CGISESSID=csm_processes) to the FMC web interface. The FMC finds the session in its database and treats the connection as valid. The attacker then authenticates using hardcoded machine-level credentials embedded in FMC's software: report:snortrules, sftop10user:snortrules, and csm_processes:csmdaemon are among the accounts that carry machine-type authentication flags. These credentials exist to support internal FMC processes and were not designed for external web access, but the session fixation flaw allows an attacker to escalate them into a full web UI session.

With an active session and CSRF token acquired from the UI, the attacker POSTs a shell payload to the /sajaxintf.cgi endpoint using the validateLicense function. This writes the payload as a Makeself-compatible install script to /var/tmp/license.tmp. A subsequent call to /pjb.cgi using the upgradeReadinessCall function triggers package_info.pl to execute the staged file as root via the Perl RunCmd wrapper. The entire chain from unauthenticated access to root shell completes in under 60 seconds against a vulnerable FMC that has not had administrator interaction since its last reboot.

Post-exploitation behavior observed across all three threat actor clusters includes JSP web shell deployment in Tomcat's webroot, JAR-based command execution, and database credential extraction via SELECT name, auth_data FROM users. See the N-able pre-auth RCE coverage from earlier this week for a parallel case where attackers exploit hardcoded credentials in another management platform to achieve the same result.

Cisco Talos identified three distinct threat actor clusters actively exploiting CVE-2026-20079, each with different objectives and post-exploitation toolsets.

UAT-12197 focuses on credential exfiltration using a living-off-the-land approach. This cluster accesses the FMC's internal database to extract administrator account hashes, uses the harvested credentials for lateral movement into the broader network, and stages exfiltration archives on the compromised FMC before transmission. The cluster avoids deploying custom malware, relying on built-in FMC utilities and standard Unix tools.

UAT-11823, attributed to Russia's Sandworm (GRU Unit 74455), deploys Cyclops Blink, a modular ELF implant with confirmed hash 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461. Cyclops Blink communicates over DNS-over-HTTPS to evade traditional DNS inspection, persists via /etc/init.d/ registration, and provides network scanning, packet sniffing, and file transfer capabilities. Sandworm previously deployed Cyclops Blink against WatchGuard Firebox appliances in 2022. The FMC campaign marks an expansion of that tradecraft to Cisco security infrastructure, giving the group persistent access to the management plane of enterprise firewall deployments.

UAT-11988, operating as a Qilin ransomware affiliate, uses CVE-2026-20079 as initial access for financially motivated intrusions. Post-exploitation behavior includes extensive Active Directory reconnaissance, credential harvesting from the FMC database, SOCKS5 and reverse-SSH tunneling to establish persistent access channels, and antivirus evasion techniques. This cluster's activity timeline places the FMC compromise as the initial foothold before domain-wide ransomware deployment.

Censys scanning identifies approximately 300 internet-exposed Cisco FMC instances as of September 2026. FOFA scans find between 600 and 700 instances. The discrepancy reflects differing scan coverage and identification heuristics across the two platforms, but both confirm that a meaningful number of FMC deployments remain directly accessible from the internet.

FMC is a management appliance that should never be internet-facing under any recommended Cisco deployment architecture. Cisco's design guidance places the FMC on a dedicated out-of-band management network with no internet connectivity. Organizations that have exposed FMC web interfaces for remote administration convenience have created exactly the attack surface CVE-2026-20079 requires.

The 300-700 exposed instance count understates the total vulnerable population. On-premises FMC deployments that sit behind VPNs or management network firewalls are still vulnerable to attackers who have gained any foothold on the management network through other means. CVE-2026-20079 is not exclusively an internet-facing threat: any attacker with network access to the FMC management interface can exploit it.

The parallel WatchGuard Firebox case is instructive. When CISA first flagged CVE-2025-14733 in December 2025, over 115,000 WatchGuard Firebox appliances were unpatched. Nine months later, nearly 9,000 remained vulnerable. Cisco FMC's smaller exposed count reflects its role as a premium enterprise appliance rather than a lower-cost SMB product, but the patch lag pattern repeats across all perimeter device categories. See the SonicWall SSRF zero-day coverage for the same pattern on another enterprise perimeter product.

Block the five confirmed C2 IP addresses across your perimeter and SIEM. Check /var/log/messages for the license.tmp execution entry. Audit Tomcat webroot for unauthorized JSP files. Any single match warrants treating the FMC as compromised and engaging Cisco TAC.

Two rules target the primary exploitation phases of CVE-2026-20079. Rule 1 detects the web request pattern that initiates the session fixation attack. Rule 2 detects the root code execution via the license.tmp upgrade mechanism. Both carry status: experimental.

Rule 1 - Session Fixation Detection: Monitors FMC web server access logs for requests to /login.cgi carrying the static csm_processes session cookie value.

• Log sources: Apache HTTPD access logs from the FMC management interface; requires access log collection into the SIEM

Rule 2 - Root Execution Detection: Monitors process creation logs for package_info.pl executing with a license.tmp argument, the direct signature of CVE-2026-20079 privilege escalation.

• Log sources: Linux auditd or sysmon-for-linux process creation telemetry from FMC host; requires host-based agent or auditd log forwarding

Cisco released FMC 7.0.0 on July 29, 2026 with a fix that adds X-Auth-User-Type header validation in the Apache HTTPD configuration, preventing machine-type sessions from being upgraded by web UI interactions. The fix is 25 lines of code. There is no workaround that achieves the same protection without the patch.

Apply the patch, then verify the FMC was not compromised during the exposure window. Patching a compromised FMC does not remove backdoors or unauthorized accounts. Complete the checklist below before declaring the FMC clean.

Cisco FMC is not a regular server. It is the management plane for enterprise firewall policy. An attacker who owns the FMC owns the ruleset that every downstream Cisco firewall enforces. That means they can silently permit their own traffic, block security monitoring tools from detecting them, and disable logging for specific source IP ranges, all without touching any managed firewall directly. The three confirmed threat actor clusters exploiting CVE-2026-20079 understood this. Sandworm installed Cyclops Blink for long-term persistence. The Qilin affiliate positioned for ransomware deployment. The credential-theft cluster exfiltrated firewall configuration data that maps the network topology for future operations.

The September 12, 2026 CISA deadline applies to federal agencies, but the threat is not limited to government networks. Any organization using Cisco FMC with an internet-accessible management interface is a live target today. Apply FMC 7.0.0, verify no compromise occurred during the exposure window, and restrict FMC access to management networks immediately.