Hunt the FMC shell that opens AD for Qilin

The traces still on the management plane are not a closed patch ticket. They are a Tomcat JSP named home.jsp that Base64-decodes F6C1F0E7, a package_info.pl line that runs /var/tmp/license.tmp --lsm as root, and a Python socks5.py reverse-SSH tunnel that forwards LDAP, Kerberos, SMB, and WinRM out of Secure Firewall Management Center into Active Directory.

Cisco Secure Firewall Management Center centrally manages your Secure Firewall estate. CVE-2026-20079 is a critical authentication bypass and CVE-2026-20316 is a static-credential flaw. CISA put CVE-2026-20079 on KEV with a federal remediation date of 12 September 2026. Hot fixes exist for FMC 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0.

This hunt shop is not a second CVSS recap. Three clusters on the same management plane leave artifacts that your SIEM can still catch.

How the three FMC clusters show up without the recipe

Talos's three-cluster shape is enough for the hunt. UAT-12197 places a malicious JSP web shell in the CSM Tomcat webroot, decodes F6C1F0E7, and drops cmd.jar. UAT-11823 updates license.tmp with a MakeSelf copy that opens a Netcat reverse shell.

UAT-11988 uses socks5.py and reverse-SSH toward LDAP 389, LDAPS 636, Kerberos 88, SMB 445, NetBIOS 135, and WinRM 5985. Talos describes TTPs consistent with Qilin affiliates. Do not treat every socks5 hit as proven Qilin.

A patched FMC build is not a clean bill for last month's management exposure. If indicators are present, contact Cisco TAC, rotate credentials, keys, and certificates, and hunt the artifacts below.

What still sits on the management plane

In expert mode, zgrep package_info.*license /var/log/messages* and look for /var/tmp/license.tmp with package_info.pl and --lsm. Hunt Tomcat webroot writes carrying F6C1F0E7, home.jsp, and cmd.jar. Hunt socks5.py, reverse-SSH, and sessions toward AD ports. Cisco also published Snort rules 66075 through 66080.

Cisco FMC hunts

Paste these. Bound to the Cisco, Help Net Security, The Hacker News, and Security Affairs artifacts above. Window starts at datetime(2026-07-01). They do not reconstruct the exploit recipe.

Hunt Cisco FMC in KQL

// FMC syslog ingest: package_info.pl + /var/tmp/license.tmp --lsm
Syslog
| where TimeGenerated >= datetime(2026-07-01)
| where SyslogMessage has_any ("package_info.pl", "/var/tmp/license.tmp", "license.tmp", "--lsm")
| project TimeGenerated, Computer, HostName, SyslogMessage, SourceIP

DeviceFileEvents
| where Timestamp >= datetime(2026-07-01)
| where FileName in~ ("home.jsp", "cmd.jar", "socks5.py", "license.tmp")
  or FolderPath has_any ("license.tmp", "Tomcat", "webroot", "/var/tmp/")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256

DeviceProcessEvents
| where Timestamp >= datetime(2026-07-01)
| where ProcessCommandLine has_any ("package_info.pl", "/var/tmp/license.tmp", "socks5.py", "F6C1F0E7")
  or FileName in~ ("package_info.pl", "socks5.py", "cmd.jar")
  or ProcessCommandLine has_any ("Invoke-TheHash", "impacket", "secretsdump")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName

DeviceNetworkEvents
| where Timestamp >= datetime(2026-07-01)
| where RemotePort in (389, 636, 88, 445, 135, 5985) or LocalPort in (389, 636, 88, 445, 135, 5985)
| where InitiatingProcessFileName in~ ("python", "python3", "ssh", "sshd", "nc", "ncat", "socks5.py")
| project Timestamp, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, Protocol

Hunt Cisco FMC in Falcon CQL

#event_simpleName=*
| timestamp>=#2026-07-01#
| (RawMessage=*package_info.pl* OR Message=*package_info.pl* OR RawMessage=*/var/tmp/license.tmp* OR Message=*/var/tmp/license.tmp* OR RawMessage=*F6C1F0E7* OR Message=*F6C1F0E7*)
| table timestamp, ComputerName, event_simpleName, Facility, RawMessage, Message

event_simpleName=ProcessRollup2
| timestamp>=#2026-07-01#
| (CommandLine=*package_info.pl* OR CommandLine=*/var/tmp/license.tmp* OR CommandLine=*socks5.py* OR CommandLine=*F6C1F0E7* OR CommandLine=*impacket* OR ImageFileName=*cmd.jar*)
| table timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine

event_simpleName=FileWritten OR event_simpleName=NewExecutableWritten
| timestamp>=#2026-07-01#
| (FileName=*home.jsp* OR FileName=*cmd.jar* OR FileName=*socks5.py* OR FileName=*license.tmp* OR FilePath=*/var/tmp/license.tmp* OR FilePath=*Tomcat*)
| table timestamp, ComputerName, UserName, ImageFileName, FileName, FilePath

event_simpleName=NetworkConnectIP4 OR event_simpleName=NetworkConnectIP6
| timestamp>=#2026-07-01#
| (RemotePort=389 OR RemotePort=636 OR RemotePort=88 OR RemotePort=445 OR RemotePort=135 OR RemotePort=5985 OR LocalPort=389 OR LocalPort=636 OR LocalPort=88 OR LocalPort=445 OR LocalPort=135 OR LocalPort=5985)
| (ImageFileName=*python* OR ImageFileName=*ssh* OR ImageFileName=*nc* OR CommandLine=*socks5.py*)
| table timestamp, ComputerName, ImageFileName, LocalPort, RemoteAddressIP4, RemotePort

Hunt Cisco FMC in Splunk

earliest=07/01/2026:00:00:00
(index=linux OR index=syslog OR index=fmc OR index=cisco OR index=web OR index=proxy OR index=firewall OR index=network OR index=snort)
("package_info.pl" AND ("license.tmp" OR "/var/tmp/license.tmp" OR "--lsm") OR "F6C1F0E7" OR "home.jsp" OR "cmd.jar" OR "socks5.py" OR "Invoke-TheHash" OR "impacket" OR sid IN (66075,66076,66077,66078,66079,66080))

Hunt Cisco FMC in Kibana

@timestamp >= "2026-07-01" AND (
  message:("package_info.pl" AND ("license.tmp" OR "/var/tmp/license.tmp" OR "--lsm"))
  OR message:("/var/tmp/license.tmp" OR "F6C1F0E7" OR "home.jsp" OR "cmd.jar" OR "socks5.py")
  OR file.name:("home.jsp" OR "cmd.jar" OR "socks5.py" OR "license.tmp")
  OR process.command_line:(*package_info.pl* OR */var/tmp/license.tmp* OR *socks5.py* OR *F6C1F0E7* OR *impacket*)
  OR rule.id:(66075 OR 66076 OR 66077 OR 66078 OR 66079 OR 66080)
)

Sources

Cisco PSIRT, Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability, updated 9 September 2026. Primary for CVE-2026-20079, hot fixes, package_info.pl, /var/tmp/license.tmp --lsm, Snort 66075-66080, and active exploitation.

Help Net Security, Cisco FMC bugs exploited by nation-state and ransomware actors, 10 September 2026.

The Hacker News, Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware, 11 September 2026.

Security Affairs, Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware, 11 September 2026.

What This Means for Your Team

This case does not open on patch FMC and closes the ticket. It opens when /var/log/messages shows package_info.pl /var/tmp/license.tmp --lsm, Tomcat webroot grows a home.jsp that speaks F6C1F0E7 or cmd.jar, or the management plane runs socks5.py and reverse-SSH toward LDAP, Kerberos, SMB, and WinRM. Hot fixes stop future abuse. They do not erase traces already on the box. Hunt those artifacts while management exposure is in scope.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We hunt forwarded syslog hits on package_info.pl and /var/tmp/license.tmp, Tomcat webroot writes tied to home.jsp, cmd.jar, and F6C1F0E7, process and network evidence of socks5.py plus reverse-SSH toward 389, 636, 88, 445, 135, and 5985 from FMC assets, Impacket and Invoke-TheHash on the far side of that tunnel, and Snort 66075-66080 where alerts land in Sentinel.

Assessing Your Security Posture with free Inception Foresight M365 Assessment

Want to see where your environment stands against Cisco FMC traces like these? Grab our free Inception Foresight M365 Assessment. No strings. Follow Inception Security on LinkedIn and @inceptionsec on X.