# Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)

> Eclypsium's September 2026 InfraTrust Pulse report documents 158 new security advisories across 17 vendors (1,699 vulnerabilities tracked, 42 critical, 8 with maximum CVSS 10.0 scores, 71 remotely exploitable without authentication, 5 added to CISA KEV) targeting enterprise network and infrastructure management systems. Cisco Talos confirmed active exploitation of a maximum-severity Cisco Secure Firewall Management Center authentication bypass (CVE-2026-20079, chained with CVE-2026-20316) by three threat clusters deploying a Cyclops Blink implant variant tied to the Sandworm/IRON VIKING group and Qilin ransomware, while a CVSS 10.0 Cisco ISE authentication bypass (CVE-2026-76460) and chained SonicWall SMA 1000 SSRF/command-injection flaws (CVE-2026-83548/83549) were also confirmed under active attack.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2630
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-eclypsium-infratrust-report-tl-2026-2630.webp?v=6420a70b (Threadlinqs threat intel: Eclypsium InfraTrust report (TL-2026-2630) — Critical severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2630
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Sandworm FMC intrusion cluster (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)
- **CVEs:** CVE-2026-20079, CVE-2026-20316, CVE-2026-76460, CVE-2026-83548, CVE-2026-83549, CVE-2026-85102, CVE-2026-85103, CVE-2026-91843, CVE-2026-73453, CVE-2026-73456, CVE-2026-20212, CVE-2026-31431, CVE-2026-20293, CVE-2026-33197, CVE-2026-6485

## Description

Eclypsium's InfraTrust Pulse report for the August 25-September 17, 2026 window catalogs 158 new advisories across 17 network and infrastructure vendors, noting that for the second consecutive month the highest-value exploited flaws were found in administrative/management software rather than the network devices themselves.

The most severe confirmed-active campaign centers on Cisco Secure Firewall Management Center (FMC). CVE-2026-20079 (CVSS 10.0, CWE-288) is an authentication-bypass-using-an-alternate-path flaw in the FMC web interface stemming from an improper system process created at boot time; unauthenticated attackers can send crafted HTTP requests to bypass authentication and execute script files as root. Cisco disclosed it July 29, 2026 with indicators already showing exploitation; Cisco confirmed active exploitation and CISA added it to KEV on September 9, 2026. CVE-2026-20316 (CVSS 5.3) allows remote login with a low-privileged/static account and is chained with CVE-2026-20079 for privilege escalation and sensitive-data access. Cisco Talos attributed post-compromise activity on compromised FMC instances to three distinct clusters: UAT-12197 (credential-harvesting operation that deployed a JSP web shell in the Tomcat webroot and a malicious command-execution JAR that invoked FMC's built-in OmniQuery.pl utility to dump the users table, including auth_data); UAT-11823 (state-sponsored, Sandworm/IRON VIKING-linked, which trojanized the FMC package_info.pl utility via a malicious license.tmp Makeself package, established a Netcat reverse shell to attacker infrastructure, and ultimately deployed a Cyclops Blink ELF implant named "timezone_check" -- the same malware family the UK NCSC first analyzed in 2022 -- with persistence via /etc/init.d/, DNS-over-HTTPS C2 resolution, file transfer, credential harvesting, command execution, network scanning and packet-sniffing capabilities); and UAT-11988 (a Qilin ransomware affiliate that logged in via CVE-2026-20316's static credentials, abused the same package_info.pl/license.tmp mechanism, then used built-in FMC tooling and living-off-the-land techniques -- Impacket, Invoke-TheHash, a Python SOCKS5 proxy and reverse-SSH tunnels forwarding LDAP/LDAPS/Kerberos/SMB/NETBIOS/WinRM ports -- to enumerate Active Directory, harvest domain and MySQL credentials, terminate security tooling, and deploy Qilin ransomware).

A second maximum-severity flaw, CVE-2026-76460 (CVSS 10.0, CWE-648), affects Cisco Identity Services Engine (ISE) and ISE-PIC: an API endpoint that should have required authentication did not, letting an unauthenticated remote attacker bypass the web management interface and obtain root command execution. It was already under active exploitation when Cisco disclosed it September 16, 2026, and CISA added it to KEV the same day with a compressed three-day FCEB remediation deadline (September 19).

SonicWall SMA 1000 appliances (models 6210/7210/8200v) were hit by a chained zero-day pair: CVE-2026-83548 (CVSS 10.0, CWE-918/CWE-441), a pre-authentication SSRF in the Appliance Work Place that lets the appliance be abused as an unintended forward proxy, chained with CVE-2026-83549, an OS command injection in the Appliance Management Console requiring admin access. SonicWall confirmed exploitation of both in the same investigated incident and recommended re-imaging rather than in-place remediation; both were added to CISA KEV September 2, 2026.

Check Point disclosed (not yet observed exploited, but flagged "imminent" by the Dutch NCSC) CVE-2026-85102 (CVSS 9.8, VPN certificate-validation authentication bypass enabling pre-auth RCE on Security Gateway during Remote Access/Site-to-Site VPN negotiation), CVE-2026-85103 (CVSS 9.8, heap-based buffer overflow while decoding a VPN certificate's ASN.1 structure), and CVE-2026-91843 (unauthenticated login-process flaw yielding root code execution on Check Point management/logging servers). Fixes shipped via LivePatch Take 24 beginning September 9, 2026.

Arista published 34 advisories September 9, 2026 including CVE-2026-73453 (CVSS 10.0, unauthenticated arbitrary code execution via the P4Runtime service on TCP/9559, disabled by default) and CVE-2026-73456 (CVSS 10.0, unauthenticated code injection via the gRPC Network Packet Sampling Interface, gNPSI, also disabled by default); neither is known to be exploited. Cisco Nexus 9000 switches with Silicon One ASICs carry CVE-2026-20212 (CVSS 9.8), an unauthenticated root-RCE exposure discovered by Cisco TAC where TCP ports 43210/43211 are reachable via the default L3 VRF and can crash the S1HAL process or execute attacker input as root; no known public exploitation as of the September 2, 2026 advisory.

A Linux kernel local-privilege-escalation flaw, CVE-2026-31431 ("Copy Fail", CVSS 7.8), was disclosed April 29, 2026 in the algif_aead AF_ALG crypto socket interface: an in-place memory-reuse optimization added in 2017 lets an unprivileged local user corrupt the page cache backing setuid binaries and obtain root in seconds, enabling container breakout and multi-tenant compromise. It affects virtually every Linux distribution shipped since 2017 and was added to CISA KEV in May 2026; it reappeared across 19 separate vendor advisories from Arista, F5, Juniper, Extreme Networks, HPE Aruba and Dell (14 Dell advisories spanning VxRail, PowerFlex, ThinOS, PowerProtect and Networking OS10) in this reporting window, illustrating the multi-vendor supply-chain blast radius of unpatched upstream kernel code.

A family of UEFI Secure Boot bypass flaws -- CVE-2026-20293 (Cisco UCS, CVSS 7.1), CVE-2026-33197 (AMI Aptio V BDS module, CVSS 8.7) and CVE-2026-6485 (Insyde InsydeH2O, CVSS 8.2) -- share a common root cause: a UEFI Shell module embedded in SPI flash whose boot-option removal logic can be abused (via shell commands, startup scripts, or crafted boot entries) to bypass Secure Boot validation and execute unsigned pre-OS code, affecting AMI, Dell, Cisco, Lenovo and Supermicro firmware.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1037.004 RC Scripts
- T1542 Pre-OS Boot
- T1611 Escape to Host
- T1553.006 Code Signing Policy Modification
- T1003 OS Credential Dumping
- T1552.001 Credentials In Files
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1040 Network Sniffing
- T1021.006 Windows Remote Management
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071.004 DNS
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized package_info.pl Execution, OmniQuery.pl Credential Dump & Cyclops Blink /etc/init.d Persistence** (`TL-2026-2630-SPL-002`)

Detects post-exploitation activity on compromised Cisco FMC appliances: UAT-11823/UAT-11988's abuse of the legitimate package_info.pl utility against a trojanized /var/tmp/license.tmp Makeself package for root code execution, UAT-12197's OmniQuery.pl-based dump of the FMC users table (including auth_data), and the Cyclops Blink 'timezone_check' ELF implant establishing persistence via /etc/init.d/.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078, T1059.004, T1037.004, T1003, T1552.001
- **Data sources:** linux_auditd, cisco_fmc_syslog, sysmon_linux, file_integrity_monitoring
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network_appliance sourcetype="cisco:fmc:auditd" OR sourcetype="linux:auditd"
| eval cmdline=coalesce(exec, command, cmdline)
| where match(cmdline, "(?i)package_info\.pl\s+--lsm") OR match(cmdline, "(?i)/var/tmp/license\.tmp")
  OR (match(cmdline, "(?i)OmniQuery\.pl") AND match(cmdline, "(?i)SELECT\s+name,\s*auth_data\s+FROM\s+users"))
  OR match(cmdline, "(?i)/etc/init\.d/timezone_check")
| eval technique=case(
    match(cmdline, "(?i)package_info\.pl|license\.tmp"), "trojanized_package_info_execution",
    match(cmdline, "(?i)OmniQuery\.pl"), "credential_table_dump",
    match(cmdline, "(?i)timezone_check"), "cyclops_blink_persistence",
    true(), "unknown")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(cmdline) as commands by host, user, technique
| where hits > 0
| sort - hits
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("package_info.pl --lsm", "/var/tmp/license.tmp", "OmniQuery.pl", "SELECT name, auth_data FROM users", "/etc/init.d/timezone_check")
| extend Technique = case(
    SyslogMessage has_any ("package_info.pl", "license.tmp"), "trojanized_package_info_execution",
    SyslogMessage has "OmniQuery.pl", "credential_table_dump",
    SyslogMessage has "timezone_check", "cyclops_blink_persistence",
    "unknown")
| summarize HitCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(SyslogMessage) by HostName, Technique
| union (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FolderPath has "/etc/init.d/" and FileName == "timezone_check"
    | project TimeGenerated, DeviceName, FolderPath, FileName
)
```

### Sigma

```yaml
title: Cisco FMC Trojanized package_info.pl Execution and OmniQuery.pl Credential Dump (Cyclops Blink / Qilin Post-Exploitation)
id: 9d3b2f4a-5c6d-4e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects execution of FMC's legitimate package_info.pl utility against a trojanized license.tmp Makeself package, OmniQuery.pl database dumps of the users table, and Cyclops Blink implant persistence via /etc/init.d/timezone_check.
references:
    - https://blog.talosintelligence.com/fmc-ongoing-exploitation/
    - https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities
author: Threadlinqs Team
date: 2026-09-23
tags:
    - attack.execution
    - attack.t1059.004
    - attack.persistence
    - attack.t1037.004
    - attack.credential-access
    - attack.t1003
    - attack.t1552.001
    - attack.initial-access
    - attack.t1078
    - attack.tool.cyclops_blink
    - cve.2026.20316
logsource:
    category: process_creation
    product: linux
detection:
    selection_trojan:
        CommandLine|contains:
            - 'package_info.pl --lsm'
            - '/var/tmp/license.tmp'
    selection_dump:
        CommandLine|contains:
            - 'OmniQuery.pl'
            - 'SELECT name, auth_data FROM users'
    selection_persist:
        CommandLine|contains: '/etc/init.d/timezone_check'
    condition: selection_trojan or selection_dump or selection_persist
falsepositives:
    - Legitimate FMC license installation via package_info.pl performed by an authenticated administrator
    - Authorized database export/support scripts invoking OmniQuery.pl
level: critical
```

**Known false positives:**

- Legitimate FMC license installation via package_info.pl performed by an authenticated administrator during routine maintenance
- Authorized database export/support scripts invoking OmniQuery.pl for troubleshooting

**Tuning notes:** Requires Linux auditd (execve rule on package_info.pl/OmniQuery.pl) or FMC-native command auditing forwarded to the SIEM; if unavailable, prioritize deploying the SIG-002/file-integrity leg for /etc/init.d/timezone_check as an interim compensating control.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Cisco FMC/ISE/SonicWall SMA Unauthenticated Management-Interface Exploitation & JSP Web Shell Drop (locked: unlock with TL Creds)
- Trojanized package_info.pl Execution, OmniQuery.pl Credential Dump & Cyclops Blink /etc/init.d Persistence (locked: unlock with TL Creds)
- FMC Post-Compromise C2 — Netcat Reverse Shell, Cyclops Blink C2 IPs & SOCKS5/Reverse-SSH AD Lateral Movement (locked: unlock with TL Creds)
- Cisco FMC/ISE/SonicWall SMA Unauthenticated Management-Interface Exploitation & JSP Web Shell Drop (locked: unlock with TL Creds)
- Trojanized package_info.pl Execution, OmniQuery.pl Credential Dump & Cyclops Blink /etc/init.d Persistence (locked: unlock with TL Creds)
- FMC Post-Compromise C2 — Netcat Reverse Shell, Cyclops Blink C2 IPs & SOCKS5/Reverse-SSH AD Lateral Movement (locked: unlock with TL Creds)
- Cisco FMC/ISE/SonicWall SMA Unauthenticated Management-Interface Exploitation & JSP Web Shell Drop (locked: unlock with TL Creds)
- FMC Post-Compromise C2 — Netcat Reverse Shell, Cyclops Blink C2 IPs & SOCKS5/Reverse-SSH AD Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `208.123.119[.]215`
- File hash: `b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d`
- IP address: `89.34.96[.]56`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [InfraTrust report warns network management systems under attack](https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/)
- [Active exploitation of Cisco Secure Firewall Management Center vulnerabilities](https://blog.talosintelligence.com/fmc-ongoing-exploitation/)
- ["Eye" spy: Cyclops Blink returns with extended capabilities](https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities)
- [Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks](https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html)
- [Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware](https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html)
- [SonicWall SMA 1000 appliances under attack via zero-day flaws](https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/)
- [Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0016)](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW)
- [CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments](https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/)
- [Cisco drops another exploited zero-day, this time a perfect 10](https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180)
- [Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root](https://thehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html)
- [Cisco Security Advisory: Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)
- [Action Required - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-85103](https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995)
- [CERT-EU - High Vulnerability in the Linux Kernel ("Copy Fail")](https://cert.europa.eu/publications/security-advisories/2026-005/)
- [Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware](https://securityaffairs.com/198884/cyber-crime/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2630