A cybersecurity analyst monitors a network attack diagram and global threat map in a dark control room.
Eclypsium's September 2026 InfraTrust Pulse reports that attackers are increasingly going after the consoles used to manage enterprise networks rather than the firewalls and switches those consoles control. The clearest examples are Cisco Secure Firewall Management Center (FMC) flaw CVE-2026-20079 and Cisco Identity Services Engine (ISE) flaw CVE-2026-76460, both exploited in real attacks and both giving the attacker root access. BleepingComputer reported the findings on September 23. Eclypsium's point is simple and backed by what attackers have actually done: a management console holds the credentials and the change-control path for every device under it, so breaking into one console can put a whole estate within reach. Cisco Talos's investigation of the FMC intrusions shows one group moving from a firewall manager into Active Directory and ending with Qilin ransomware on Windows endpoints.

Eclypsium's September InfraTrust Pulse Flags Management Planes for the Second Month Running​

InfraTrust Pulse is Eclypsium's monthly digest of security advisories for network gear, servers, firmware and chips. The September edition covers advisories published between August 25 and September 17. According to BleepingComputer's account, it tracked 158 new advisories from 17 vendors covering 1,699 vulnerabilities. Of those advisories, 42 were rated critical and eight had a maximum CVSS score of 10.0. The report counts 71 flaws that can be exploited remotely without logging in, and five advisories contained flaws that later landed on CISA's Known Exploited Vulnerabilities (KEV) catalog. KEV is the US government's list of vulnerabilities confirmed as exploited in the wild.

The numbers keep climbing. Eclypsium launched the series in July, and the inaugural July 2026 InfraTrust Pulse tracked 61 infrastructure advisories from 14 vendors, including six critical advisories and 26 remotely exploitable, unauthenticated vulnerabilities. The August edition identified 118 new advisories covering 1,051 CVEs. The reporting windows and vendor counts differ, so the three months don't compare perfectly. The direction is still clear.

The report's main argument is that the trend has continued. It calls September "the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software." Independent coverage of the August edition backs that up. SecurityBrief reported that Paul Asadoorian, the researcher leading the report, said attacks during the period were concentrated on the management plane rather than the network devices themselves, and that the August report highlighted exploited flaws affecting Cisco Secure Firewall Management Centre, Arista VeloCloud Orchestrator, HPE Aruba SD-WAN Orchestrator and Check Point SmartConsole.

The report also explains how it counts. InfraTrust counts vendor advisories rather than individual CVEs, because one infrastructure advisory can bundle dozens or hundreds of fixes. It ranks flaws by exploitability, reachability and exposure rather than CVSS score alone. That approach suits a month in which the most important bugs sat in software that is rarely on the public internet but controls everything that is.

Cisco Secure FMC CVE-2026-20079 Went From a March Patch to an August Breach​

CVE-2026-20079 has a longer history than most of the flaws in the report. Cisco first published the advisory on March 4, 2026, as part of its semiannual firewall bundle. It describes a CVSS 10.0 authentication bypass in the FMC web interface. The cause is an improper system process created at boot time. Crafted HTTP requests let an unauthenticated remote attacker run scripts and commands as root. The flaw affects Cisco Secure FMC Software and Cisco Security Cloud Control (SCC) Firewall Management regardless of configuration. Cisco has already fixed the SaaS-delivered SCC product for its customers, and says Firewall Device Manager, ASA and FTD software are not affected.

The advisory's revision history shows how the picture changed over the summer. On July 31, Cisco added a second bug ID, indicators of compromise and hot fixes. BleepingComputer had reported on July 29 that the /var/tmp/license.tmp indicator was shared with attacks exploiting a second FMC flaw, CVE-2026-20316. At the time, Cisco said it was not aware of exploitation of CVE-2026-20079. On September 9, Cisco said its PSIRT had learned of active exploitation in August, and CISA added the flaw to KEV the same day. Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.

Cisco Talos published its analysis on September 9 and describes three clusters of post-compromise activity:

  • UAT-12197 exploited CVE-2026-20079, placed a JSP web shell in the FMC's Tomcat webroot, and used a JAR-based command executor to pull user authentication data from the appliance's internal database.
  • UAT-11823 is an APT actor that Talos says overlaps in tooling with Sandworm. It exploited CVE-2026-20079 and CVE-2026-20316, replaced license.tmp with a malicious Makeself package that the legitimate package_info.pl utility ran as root, collected configurations of the devices the FMC manages, and deployed a Cyclops Blink variant. Sophos Counter Threat Unit separately analyzed a Linux implant called "timezone_check" from compromised FMC appliances and also identified it as Cyclops Blink.
  • UAT-11988 is assessed by Talos with high confidence to be a ransomware operator. It logged in with static credentials (CVE-2026-20316) and used built-in FMC tooling for reconnaissance. It then deployed Qilin ransomware.

The third cluster is the one Windows administrators should study. Talos says the malicious license file gathered Active Directory service-account credentials, domain account information and hostname-to-IP mappings for domain controllers, ADFS, Exchange, file and database servers. The attacker then built a reverse-SSH tunnel and a Python SOCKS5 proxy from the FMC that forwarded LDAP (389), LDAPS (636), Kerberos (88), SMB (445), port 135 and WinRM (5985). Tools such as impacket, Invoke-TheHash and custom antivirus killers came next, followed by Qilin on selected endpoints. A firewall manager became the way into the Windows domain.

Checking and fixing FMC​

Cisco's advisory gives a specific check. In expert mode on the FMC, run zgrep "package_info.*license" /var/log/messages* as root. A log line referencing /var/tmp/license.tmp means the vulnerability may have been exploited. If you suspect compromise, Cisco says to contact TAC immediately. It also warns that the hot fixes only prevent future exploitation and may not clean up an existing compromise.

As of the September 16 revision, Cisco has replaced the hot fixes with hardening releases. The first fixed releases are 7.0.10 (for 7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. There is no workaround. Cisco notes that keeping the FMC management interface off the public internet reduces the attack surface, and Snort rules 66075???66080 cover CVE-2026-20079.

Cisco ISE CVE-2026-76460 Was Already Being Exploited When Cisco Disclosed It​

FMC had months between patch and exploitation. ISE had none. Cisco's September 16 advisory for CVE-2026-76460 describes a CVSS 10.0 flaw caused by insufficient authentication control on an API endpoint. A crafted request lets an unauthenticated remote attacker bypass the web-based management interface's login. The flaw affects Cisco ISE and ISE Passive Identity Connector (ISE-PIC) regardless of configuration. Cisco says it found the bug while resolving a TAC support case and that its PSIRT is aware of active exploitation. CISA added it to KEV the same day.

The fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE 3.0 has reached end of software maintenance, so customers on it have to migrate to a supported release. There is no workaround. Cisco's stopgap is to use infrastructure access control lists (iACLs) that allow only the management and control-plane traffic the appliance actually needs.

Detection is harder than on FMC. Cisco says a successful exploit can give root command execution, and that attackers with that access may remove or hide evidence. The advisory suggests reviewing ise-kong/access.log on every node of a distributed deployment for suspicious usernames. It also tells administrators to cross-check network and firewall logs from outside the appliance for unexpected uploads or downloads. If malicious activity is suspected, Cisco recommends re-imaging affected nodes and restoring configuration from backup.

Accounts differ on how many maximum-severity ISE bugs shipped that day. The InfraTrust account says three ISE vulnerabilities scored 10.0. ThreatAft lists four: CVE-2026-20130 (command injection), CVE-2026-20192 (access control bypass), CVE-2026-76423 (REST API admin access), and CVE-2026-76460 (privileged API misuse). Either way, all of them are fixed by the same ISE hardening release. Across the wider September 16 release, tech-insider.org, citing SecurityWeek, counted 20 CVEs across FMC, ISE, and Nexus Dashboard combined, 12 of them rated critical.

Consoles From HPE, NVIDIA, Dell, SonicWall and Arista Share the Same Problem​

The September report stresses that the pattern isn't limited to Cisco. During the reporting period, vulnerabilities also hit HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem and Arista management interfaces. The report makes the point bluntly: "None of those is a firewall, switch, router, or fabric." Each is the console that configures those devices and stores their credentials. The report doesn't say each of those flaws was exploited, and administrators shouldn't assume they were. Its point is that these products fall into the same category of risk.

FMC also has more fixes pending. Cisco disclosed six more FMC vulnerabilities on September 16, some in sftunnel, the channel FMC uses to talk to the firewalls it manages. The Hacker News lists CVE-2026-20324 (CVSS score: 9.9) - A vulnerability in the sftunnel inter-device communication protocol of FMC Software that could allow an authenticated, remote attacker to execute arbitrary commands as root. It also reports CVE-2026-20242 (CVSS score: 9.8) - A vulnerability in the External Database Access feature of FMC Software that could allow an unauthenticated, remote attacker to execute arbitrary commands as root. The practical upshot: upgrading an FMC to the hardening release deals with the exploited pair and this new batch in one maintenance window.

SonicWall SMA 1000, Check Point VPN and Arista EOS Keep Edge Devices in the Picture​

Edge devices are still under attack too. SonicWall SMA 1000 remote-access appliances were hit by a chained pair of flaws. CVE-2026-83548 is a CVSS 10.0 unauthenticated server-side request forgery in the Appliance Work Place interface. CVE-2026-83549 is an OS command injection in the Appliance Management Console, the product's own admin interface. InfraTrust says chaining the two gives unauthenticated remote code execution. CISA added both to KEV on September 2, and SonicWall has confirmed exploitation. SonicWall tells customers to upgrade to the latest hotfix and look for signs of compromise. If a device is compromised, it says to re-image physical appliances or redeploy virtual ones rather than try to clean them in place.

Don't confuse this with SonicWall's July SMA 1000 incident. That one involved CVE-2026-15409 and CVE-2026-15410, with fixed builds 12.4.3-03453 and 12.5.0-02835. Those build numbers belong to the July advisory. Don't treat them as the fix for the September pair without checking SonicWall's current advisory.

Check Point disclosed three critical unauthenticated, remotely exploitable flaws. CVE-2026-85102 is an authentication bypass that can lead to remote code execution in Remote Access and Site-to-Site VPN. CVE-2026-85103 is a memory corruption bug that can also lead to code execution. CVE-2026-91843, in an unauthenticated login process, can give root code execution on several Check Point management and logging servers, which fits the report's theme. The Dutch Nationaal Cyber Security Centrum urged administrators to install updates and warned that exploitation was imminent. No confirmed exploitation has been reported.

Two switch flaws complete the list. Arista published 34 advisories on September 9. They include CVE-2026-73453 in the P4Runtime service (TCP 9559) and CVE-2026-73456 in gNPSI, both maximum-severity unauthenticated RCEs on EOS. Both features are disabled by default, and Arista says neither flaw is known to be exploited. Only switches where someone has turned these services on are exposed. Cisco's September 2 advisory for CVE-2026-20212 on Nexus 9000 describes root code execution through TCP ports 43210 and 43211, which are reachable by default in the affected Layer 3 configuration. Cisco lists a workaround.

CopyFail and the UEFI Shell Bypass Show Fixes Arriving on Each Vendor's Schedule​

The report's supply-chain finding will be familiar to anyone who patches appliances. CVE-2026-31431, the Linux kernel privilege-escalation bug known as "CopyFail," went onto KEV in May. It now appears in 19 separate advisories from six vendors. Arista, F5, Juniper, Extreme Networks and HPE Aruba each published one. Dell accounts for 14, covering VxRail, PowerFlex, ThinOS, PowerProtect and Networking OS10. In the report's words, "one upstream defect created nineteen remediation tasks," each with its own advisory number and release date. A team that tracks CopyFail only as a Linux server issue will miss the storage, hyperconverged and thin-client products that ship their own kernels.

Firmware carries the same delay. Eclypsium found a UEFI Shell Secure Boot bypass and disclosed it through CERT/CC. An attacker with access to UEFI boot settings can launch an embedded UEFI Shell that is normally blocked at startup. From there they can change Secure Boot settings in memory and run unsigned code before the operating system loads. The flaw is tracked as CVE-2026-20293 (Cisco), CVE-2026-33197 (AMI Aptio) and CVE-2026-6485 (Insyde). AMI, Dell, Cisco, Lenovo and Supermicro have released or announced fixes. The attack requires access to boot settings, so it matters most where firmware setup isn't password-protected or where attackers can reach out-of-band management.

What this means for you​

If you run any of the named management consoles, patch them first this cycle, ahead of the edge devices they manage. Cisco FMC and ISE shops have confirmed exploitation, fixed releases and no workarounds. Wait for your change window only if the appliance is already fenced off from untrusted networks, and even then only briefly. Arista EOS customers who have never enabled P4Runtime or gNPSI can schedule those updates normally. Check Point VPN and management-server owners should treat the NCSC warning as a reason to move now rather than wait for proof of exploitation.

Patching an appliance that may already be compromised doesn't clean it. Cisco says so for FMC, Cisco recommends re-imaging for ISE, and SonicWall recommends re-imaging or redeploying for SMA 1000. Where exploitation has been confirmed, investigate before you upgrade. The Talos findings also mean the investigation has to reach Active Directory, since these consoles store domain service-account credentials.

  • Upgrade Cisco Secure FMC to 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0 as appropriate, and first grep the logs for /var/tmp/license.tmp.
  • Upgrade Cisco ISE and ISE-PIC to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4, restrict access with iACLs in the meantime, and review access logs on every node.
  • Rotate Active Directory service-account and MySQL credentials stored on or reachable from a compromised FMC or ISE, and check outside logs for LDAP, Kerberos, SMB or WinRM traffic tunneled from the appliance.
  • Keep management interfaces on dedicated administrative networks, because Cisco says doing so reduces FMC's exposure and iACLs are its only ISE mitigation.
  • Track CopyFail (CVE-2026-31431) by vendor advisory across Dell, Arista, F5, Juniper, Extreme and HPE Aruba products, not just by kernel version on your Linux servers.
  • Re-image or redeploy compromised SonicWall SMA 1000 appliances rather than cleaning them in place, and confirm the current hotfix build against SonicWall's September advisory.

Two months of InfraTrust data, backed by Cisco's advisories and Talos's intrusion analysis, point the same way: the software admins use to manage the network is now a primary target. FMC shows the cost of treating a March patch as optional. ISE shows there may be no grace period at all. The next InfraTrust Pulse, covering advisories from mid-September onward, will show whether the vendors named this month add confirmed exploitation to their console advisories. For FMC and ISE customers, the hardening releases are already out.

 

Click to expand...
You must log in or register to reply here.