An infrastructure management systems attack trend has emerged as the defining theme of the September edition of Eclypsium‘s InfraTrust Pulse, with the platforms used to configure and control enterprise network devices now firmly in attackers’ crosshairs. Between 25 August and 17 September, the report tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities, 42 rated critical, eight carrying a maximum CVSS score of 10.0, and 71 exploitable remotely without authentication.
Five of the advisories contained vulnerabilities that made it onto CISA‘s Known Exploited Vulnerabilities (KEV) catalog. But the headline finding is not the raw volume; it is where the most dangerous flaws are appearing.
Infrastructure Management Systems Attack Trend Runs for a Second Consecutive Month
‘This is the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software, so treat these platforms as high-value targets and patch, monitor, and harden them accordingly,’ the report states. The logic is straightforward: compromise the management console and you hold the keys to every device it controls, along with their credentials and the change-control path into all of them at once.
The most serious individual case involves CVE-2026-20079, a maximum-severity authentication bypass in Cisco Secure Firewall Management Center (FMC). An unauthenticated attacker can send crafted HTTP requests to the FMC web interface and execute scripts and commands as root. Cisco confirmed on 9 September that the vulnerability was being actively exploited, noting that its Product Security Incident Response Team became aware of attacks in August. CISA added the flaw to the KEV catalog the same day.
The story had been developing quietly for weeks before that. As BleepingComputer previously reported, Cisco had already updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise as early as 29 July, indicators also associated with a second FMC flaw, CVE-2026-20316. The two vulnerabilities were later confirmed to have been chained together in attacks. Cisco Talos linked the activity to three threat clusters, UAT-12197, UAT-11823, and UAT-11988, which include state-sponsored actors and ransomware gangs.
The attackers used built-in FMC tools for reconnaissance, deployed tunnelling utilities, harvested credentials, and in some cases delivered Qilin ransomware encryptors. Sophos Counter Threat Unit analysed a Linux implant named ‘timezone_check’ recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with the Sandworm threat group. Cisco separately disclosed six additional FMC vulnerabilities on 16 September, including flaws in the sftunnel connection FMC uses to communicate with managed firewalls.
Cisco Identity Services Engine (ISE) was also hit. Three of the advisories disclosed on 16 September carry maximum CVSS scores of 10.0. One, CVE-2026-76460, is an authentication bypass in an API that allows unauthenticated remote attackers to execute commands as root. CISA added it to the KEV catalog on the same day Cisco disclosed it. Cisco says there are no workarounds, though restricting access via infrastructure access control lists can prevent remote exploitation.
Beyond Cisco: SonicWall, Check Point, Arista and a Supply-Chain Headache
The infrastructure management systems attack trend extends well beyond one vendor. During the same reporting period, vulnerabilities affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces. ‘None of those is a firewall, switch, router, or fabric,’ the report notes. ‘Each one is the console that configures them, holds their credentials, and provides a change-control path into all of them at once.’
Two SonicWall SMA 1000 vulnerabilities illustrate the chaining problem. CVE-2026-83548 (CVSS 10.0) is an unauthenticated server-side request forgery flaw in the Appliance Work Place interface; CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console. Chained together, they achieve unauthenticated remote code execution. CISA added both to the KEV catalog on 2 September, and SonicWall recommends that customers upgrade, investigate for compromise, and re-image or redeploy affected systems rather than attempting to clean them in place.
Check Point disclosed three critical, remotely exploitable vulnerabilities requiring no authentication. CVE-2026-85102 can lead to remote code execution in Remote Access and Site-to-Site VPN; CVE-2026-85103 is a memory corruption vulnerability that can also result in remote code execution. The Dutch Nationaal Cyber Security Centrum urged admins to install security updates, warning that exploitation was imminent. A third flaw, CVE-2026-91843, can allow attackers to execute code as root on several Check Point management and logging servers.
Arista published 34 security advisories on 9 September, two of them maximum-severity flaws allowing unauthenticated remote code execution on EOS systems. Both affected features are disabled by default, and Arista says neither is known to have been exploited.
The supply-chain dimension of the report is equally sobering. CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed ‘CopyFail’ and added to CISA’s KEV catalog in May, now appears in 19 separate security advisories from six vendors. Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published an advisory, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10. ‘One upstream defect created nineteen remediation tasks, each arriving on a different vendor schedule with a different advisory number,’ the report explains.
A separate illustration of advisory timing working against defenders: BleepingComputer reports that HP’s Poly Video advisory arrived four months after CVE-2026-21385, a Qualcomm GPU driver vulnerability included in the package, had already been exploited in attacks and added to CISA’s KEV catalog. The gap between a component being exploited and the downstream vendor shipping its own advisory is a recurring problem for infrastructure teams trying to prioritise patching.
Firmware is not off the hook either. Eclypsium disclosed a UEFI Shell Secure Boot bypass through CERT/CC that allows an attacker with access to UEFI boot settings to launch an embedded UEFI Shell normally blocked at startup, modify Secure Boot settings in memory, and run unsigned code before the operating system loads. The disclosure produced three CVEs: CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde. AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes.
For admins mapping their response, Cisco’s ISE advisory is a useful forcing function: CISA added CVE-2026-76460 to the KEV catalog on the same day Cisco disclosed it, meaning the window between disclosure and expected exploitation has, in this case, already closed.
