CISA has added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog and ordered all US federal agencies to patch by September 12, the most urgent patch timeline CISA issues. The vulnerability is a CVSS 10.0 authentication bypass in Cisco Firepower Management Center, the centralized console that controls Cisco next-generation firewall deployments across enterprise and government networks. An unauthenticated attacker with network access to the FMC web interface can execute arbitrary code with root privileges. No credentials. No phishing. One HTTP request.
Three distinct threat clusters are currently exploiting this vulnerability in active campaigns. UAT-12197, an initial access broker, is compromising FMC instances and selling footholds into victim networks. UAT-11823, assessed as the Sandworm group, is using FMC access for persistent espionage positioning inside critical infrastructure. UAT-11988, operating as an affiliate of the Qilin ransomware-as-a-service operation, is moving from FMC access to domain controller compromise and ransomware deployment using a living-off-the-land playbook that leaves minimal traces.
For enterprises, government networks, telecommunications operators, and financial institutions across Lebanon, the UAE, Saudi Arabia, and Nigeria running Cisco Firepower infrastructure at the network perimeter, this disclosure has an immediate operational question that patching does not answer: was your FMC interface reachable during the period this vulnerability was being exploited? And if it was, did something already happen?
Cisco Firepower Management Center is the administrative console for Cisco NGFW and FTD deployments, the system from which firewall policies are written, updated, and enforced across an entire network perimeter. A compromise of FMC is not a compromise of one firewall; it is administrative control over all firewalls managed by that console.
CVE-2026-20079 is an authentication bypass vulnerability in the FMC web management interface of Cisco Secure FMC Software, also referred to across Cisco advisories as Cisco Secure FMC, Secure FMC, FMC software, and firewall management center FMC software within the Cisco Secure Firewall Management and Cisco Secure Firewall Management Center stack that supports Cisco Secure Firewall and Firewall Threat Defense deployments. In practice, an unauthenticated remote attacker can exploit the flaw by sending crafted HTTP requests to the Management Center FMC Software web interface on an affected device, using crafted HTTP requests to bypass authentication without user interaction and reach the administrative API. The issue has been tied to an improper system process created during boot time on the underlying operating system, after which an attacker can execute arbitrary java code and other script files, deploy a crafted serialized java object payload or a Netcat based reverse shell, elevate privileges, and ultimately obtain root access on the system itself, giving them the ability to modify firewall policies, add administrative accounts, exfiltrate sensitive data configuration, and pivot from the management plane into managed infrastructure.
A second vulnerability, CVE-2026-20316, carries a CVSS 5.3 score and allows path traversal on the FMC web based management interface. While lower severity, it has been observed in the same exploitation chains used to identify affected software versions before the primary flaw is used, and it has also been tracked alongside discovered vulnerabilities and active reporting on Cisco Secure FMC vulnerabilities. That is why defenders should verify exposure in Cisco Secure Firewall Management deployments, review Cisco Software Checker guidance for fixed software and Cisco Secure FMC hotfixes on affected software versions, and treat patching Cisco Secure FMC, Cisco Secure FMC Software, and Management Center FMC Software as part of a rapid response to active exploitation.
The active exploitation of CVE-2026-20079 is not a single campaign. CVE-2026-20079 is an authentication bypass vulnerability in FMC software, part of Cisco Secure Firewall Threat Defense administration, that attackers exploit by sending crafted HTTP requests. Three operationally distinct threat clusters are using the same vulnerability for different purposes, which has detection implications for security teams trying to identify compromise:
Organizations should use Cisco’s Software Checker to determine exposure and identify affected Secure FMC versions and the appropriate fixed software.
Cisco Firepower is widely deployed as the perimeter firewall platform in telco data center and 5G core infrastructure across the UAE and KSA. A telco FMC compromise gives the threat actor control over the firewall policies governing customer traffic routing, peering connections, and internal segment isolation. UAT-11823's interest in telecommunications infrastructure for espionage positioning makes telco FMC instances high-priority targets. NCA ECC in Saudi Arabia requires continuous monitoring of critical perimeter infrastructure, including security cloud control SCC, a requirement that specifically applies to the monitoring of firewall management consoles against unauthorized access.
UAE and Saudi government ministry networks that use Cisco Firepower for perimeter security face exposure to both UAT-11823 (Sandworm espionage) and UAT-12197 (initial access broker activity). A government FMC compromise that goes undetected gives a sophisticated actor administrative control over the firewall policies governing internal network segmentation, including the policies that separate classified or sensitive government systems from general network access. NESA standards in the UAE require detection capabilities proportionate to the sensitivity of protected data.
Lebanese banks and Nigerian financial institutions running Cisco NGFW platforms managed through FMC face specific exposure to UAT-11988's Qilin ransomware affiliate activity. The Qilin playbook FMC access to domain controller to AD credential dump to ransomware is specifically designed to maximize damage per entry point. A single FMC instance reachable from outside the network perimeter provides the initial access that ends in enterprise-wide encryption. CBUAE and CBN cybersecurity frameworks both require documented evidence of monitoring and response capability for high-impact vulnerabilities.
Cisco has released patches and hotfixes for the affected software versions addressing CVE-2026-20079 and CVE-2026-20316. Organizations are strongly advised, and Cisco may strongly recommend, that they apply hotfixes promptly after validation or penetration testing. Exposure is not changed by device configuration, and remediation depends on moving to the fixed software release identified in Cisco’s advisory and Software Checker. Any validation or software penetration test should be scheduled at times that minimize impact on system performance. The CISA federal deadline of September 12 reflects the urgency of closing the vulnerability to future exploitation, and a comprehensive hardening release may also include internally discovered security flaws beyond the actively exploited flaw. But patching is forward-looking. The exploitation campaigns documented by Cisco and CISA were underway before the patch was released and FMC instances that were network-accessible during the exploitation window may have been compromised before the patch was applied.
Root access on an FMC appliance allows an attacker to modify system logging, remove evidence of access, add administrative accounts that survive firmware updates, and modify firewall policies in ways that create persistent network access paths. An organization that patches without conducting a retrospective review of FMC access logs, administrative account changes, and firewall policy modifications during the exposure window cannot know whether they are closing the door after the attacker has already left a key inside.
SHELT's SOC-as-a-Service monitors the behavioral indicators of Cisco FMC compromise at the management and network layer independent of the FMC's own logging, which an attacker with root access can modify:
The attack vector requires network access to the FMC web management interface. If your management VLAN is exclusively reachable from a dedicated, access-controlled jump server with no internet exposure, the direct exploitation risk is significantly reduced. However, if any host on your management VLAN was compromised through another vector such as phishing, RMM software abuse, or VPN credential theft, that compromised host provides the attacker with network access to your FMC. The critical question is not just where your FMC is reachable from, but what else is reachable from the same network segment.
Yes. Patching closes the vulnerability to future exploitation. The active exploitation campaigns documented by Cisco and CISA were underway before the patch was released. The appropriate follow-on steps are: review FMC administrative account logs for any accounts created or modified outside your provisioning process; review firewall policy change logs for modifications outside approved change windows; review FMC web access logs for HTTP requests consistent with CVE-2026-20079 exploitation; and assess whether your FMC instance was network-accessible from the internet or from any network segment that could have been compromised during the exposure window.
UAT-11988's living-off-the-land playbook generates specific network and directory artifacts. After achieving FMC access, the actor uses legitimate network management tools to enumerate internal subnets and reachable hosts, and may conduct extensive reconnaissance to build a target list inside the victim's environment. Active Directory queries originating from the FMC management process are anomalous and detectable. Domain controller authentication attempts using credentials that did not exist in the environment before the FMC compromise indicate the credential harvest phase, and the actor may use a crafted serialized java object as a command executor to obtain user authentication data. The ransomware deployment itself generates high-volume SMB activity and file modification events across multiple systems simultaneously detectable in network flow analysis before encryption completes. A Netcat-based reverse shell may also be used during post-compromise activity to maintain network access.
Yes. SHELT's SOC-as-a-Service monitoring includes Cisco FMC and FTD telemetry syslog integration, management API audit logging, and network flow analysis from managed firewall interfaces. Cisco perimeter infrastructure monitoring is a specific detection capability in our stack, not an add-on. The detection logic for CVE-2026-20079 exploitation attempts, UAT-11988 lateral movement patterns, and Qilin pre-ransomware indicators is active in our detection rules as of the date of this disclosure.
SHELT is the best Cybersecurity solutions company in Lebanon, Nigeria, UAE, and KSA with 24/7 SOC services ensuring continuous protection and rapid incident response for critical infrastructure and enterprise networks.
.png)
© SHELT 2023 Privacy Policy | Terms & Conditions
.png){kind=small}
