12 SEP 2026 — Cisco Talos has published what happened after attackers got into Secure Firewall Management Center instances through CVE-2026-20079: three unrelated groups arrived through the same door. One is most likely Russian state-sponsored. One deployed ransomware. The third stole credentials and left web shells.
The flaw is an authentication bypass rated CVSS 10.0 that gives an unauthenticated remote attacker root on the underlying operating system.
The three clusters
Talos tracks them separately because their post-compromise behaviour is distinct.
UAT-12197 exploited the flaw and deployed web shells, a Java archive used as a command executor, and credential exfiltration. That is the generic intrusion shape: establish access, keep it, take what logs in.
Talos assesses UAT-11823 as most likely Sandworm, the Russian group, based on its tooling. Having obtained access, it overwrote a file on disk called license.tmp with a malicious copy built using Makeself, establishing a Netcat reverse shell to its own command-and-control server.
UAT-11988 performed living-off-the-land reconnaissance, stole credentials, and deployed Qilin ransomware.
Why three actors in one product matters
A single intruder tells you a flaw was found. Three unrelated groups tell you it was common knowledge, and that the exploitation window was long enough for the information to travel.
It also collapses a distinction defenders rely on when triaging. Espionage and ransomware are usually treated as different threat models with different targets, different timelines and different responses. The initial access was the same for all of them. The question "would a state actor bother with us?" no longer filters anything. Whatever the answer, a ransomware crew is using the same door.
The pairing has a second consequence for incident response. An organisation that finds and evicts Qilin has not established that it was the only occupant, and the quiet cluster is by construction the one that does not announce itself.
What the clustering method can and cannot say
Talos separates these three by behaviour after the breach. Understand that limit before treating "three groups" as established fact.
Clustering by tooling and technique reliably tells you that activity looks different. It does not, on its own, prove different operators. One team can run distinct playbooks for distinct objectives, and tooling is shared, sold and stolen across the criminal market. The Sandworm attribution is explicitly an assessment based on tooling, which is the weakest kind of attribution evidence and is stated as such.
None of that changes what a defender should do. Whether this is three groups or one group wearing three hats, the same product was breached by the same flaw and the post-compromise activity ranged from quiet credential theft to ransomware. The response is identical under either reading, and the attribution question only matters for policy.
A firewall manager is not a firewall
Be precise about the target here. The product's name invites the wrong mental model.
Secure Firewall Management Center is the console that configures and pushes policy to an estate of firewalls. Root on it is not access to one security device; it is authority over what every managed firewall permits, and legitimate authority at that. Changes made from the management plane are the changes the firewalls are supposed to accept.
That is why the credential theft in two of the three clusters matters more than it would elsewhere. A management console holds the credentials used to administer the things it manages, so the loss is not confined to the box that was breached.
The implant hides in an ordinary filename
The Sandworm cluster's choice of license.tmp deserves a moment, because it is the detail most likely to defeat a hurried search.
A file with that name on a licensed commercial appliance is unremarkable. It is not hidden, not obfuscated by name and not in an unusual location. It is a plausible artefact of the product doing its job, replaced by a malicious copy. Makeself produces self-extracting archives, which is also a legitimate packaging tool.
Detection therefore depends on content and integrity rather than on anything anomalous about the name. An organisation searching its estate for suspicious filenames will find nothing; one comparing files against known-good hashes will.
What to do
Patch both CVEs, then assume compromise rather than concluding it. A CVSS 10.0 authentication bypass under exploitation by three groups is not a flaw where absence of evidence is worth much, particularly given what the implant looks like.
Rotate every credential the management centre held or could use, including the ones it uses to administer managed devices. Review firewall policy for changes that were pushed rather than made. The management plane is the one place a malicious rule looks entirely legitimate.
Then check license.tmp and its neighbours against the vendor's own hashes. Talos has published indicators, and the file-name observation above is only useful in conjunction with them.
This is the pattern, not an exception
We wrote yesterday about attackers minting administrator tokens in JFrog Artifactory, and the day before about GitLab's unauthenticated file read. This is the third maximum-or-near-maximum severity flaw in management infrastructure in three days.
The common property is not vendor quality. It is that management planes are reachable, trusted, and administered by teams whose job is availability. We have been tracking this in software at the internet-facing edge, and the consistency of it across vendors is the finding.
View author profile → · Editorial policy
