MalwareExploits 1 CVE

cmd.jar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass and Root Code ExecutionExploited in the wild

CVE-2026-20079 carries a CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass login controls, hijack an unclaimed boot-created session, and execute scripts with root privileges. Cisco confirmed in-the-wild abuse beginning in August 2026.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.004Unix ShellEvidence1

The cmd.jar command executor obtains the command from its command line and executes it using /bin/sh -c <command>. The Netcat reverse shell uses /bin/sh -i.

T1059.007JavaScriptEvidence3

The web shell was used to install a malicious JAR file named cmd.jar, which allowed them to execute commands on the server.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence2

cmd.jar [was] capable of querying the device’s internal database to steal stored user credentials; UAT-11988 harvested Active Directory and MySQL credentials.

T1552Unsecured CredentialsEvidence1

The cmd.jar command executor was capable of querying the device's internal database to steal stored user credentials.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Sep 10, 2026

Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware | Cryptika Cybersecurity

A JAR-based command-execution tool deployed on compromised FMC appliances. It can query the appliance's internal database and harvest stored user credentials.

cyber security newsNews

Sep 10, 2026

Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware

A Java Archive-based command-execution tool dropped on compromised Cisco FMC appliances. It can query the device's internal database and harvest stored user credentials.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

cmd.jar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-20079Cisco Secure Firewall Management Center Authentication Bypass and Root Code ExecutionExploited in the wild

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.004Unix ShellEvidence1

The cmd.jar command executor obtains the command from its command line and executes it using /bin/sh -c <command>. The Netcat reverse shell uses /bin/sh -i.

T1059.007JavaScriptEvidence3

The web shell was used to install a malicious JAR file named cmd.jar, which allowed them to execute commands on the server.

Credential Access

2 techniques

T1003OS Credential DumpingEvidence2

cmd.jar [was] capable of querying the device’s internal database to steal stored user credentials; UAT-11988 harvested Active Directory and MySQL credentials.

T1552Unsecured CredentialsEvidence1

The cmd.jar command executor was capable of querying the device's internal database to steal stored user credentials.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Sep 10, 2026

Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware | Cryptika Cybersecurity

A JAR-based command-execution tool deployed on compromised FMC appliances. It can query the appliance's internal database and harvest stored user credentials.

cyber security newsNews

Sep 10, 2026

Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware

A Java Archive-based command-execution tool dropped on compromised Cisco FMC appliances. It can query the device's internal database and harvest stored user credentials.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.