LOCAL EXPLOIT Cisco FMC cmd.jar command executor retrieved or uploaded (CVE-2026-20079 post-exploitation)

Ali AlEnezi@site

•updated Sep 14, 2026•0•0•3

Detects HTTP requests attempting to access 'cmd.jar' on Cisco Firepower Management Center (FMC) devices, which is indicative of post-exploitation activity related to CVE-2026-20079, where an attacker may be attempting to retrieve or upload a command executor.