Attackers Turn Network Management Consoles Into Gateways for Infrastructure-Wide Compromise

Centralized administration creates a concentrated attack surface

Enterprise management platforms are increasingly becoming the first target in attacks against network infrastructure. These systems often store credentials, push configuration changes, and control fleets of firewalls, switches, VPN gateways, and fabric devices.

Between August 25 and September 17, 2026, Eclypsium’s InfraTrust tracked 158 advisories from 17 vendors, covering 1,699 vulnerabilities. The total included 42 critical-rated advisories, eight flaws with CVSS scores of 10.0, and 71 vulnerabilities remotely exploitable without authentication.

Five advisories contained vulnerabilities subsequently added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. This is the second consecutive reporting period in which the most consequential exploited infrastructure flaws were concentrated in administrative software.

Products implicated in this broader pattern include Cisco Secure Firewall Management Center (FMC), Cisco Identity Services Engine (ISE), HPE Fabric Composer, HPE EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.

The consequences extend beyond the compromised console. Root access to a management server may expose device credentials, configuration data, administrative sessions, and the mechanisms used to change downstream infrastructure.

Cisco FMC flaws were chained in ransomware-linked intrusions

Two Cisco Secure Firewall Management Center vulnerabilities were combined in observed attacks.

CVE-2026-20079 is an authentication bypass affecting FMC 7.0.0. It carries a CVSS score of 10.0 and is classified as CWE-288, authentication bypass through an alternate path or channel.

An unauthenticated attacker can send crafted HTTP requests to the FMC web interface, bypass access controls, and execute scripts or operating-system commands as root. The underlying problem involves a system process created incorrectly during boot.

Cisco confirmed active exploitation on September 9, 2026, and said its incident response team had become aware of attacks during August. CISA added the flaw to KEV on September 9, setting a September 12 deadline for US federal agencies.

The second flaw, CVE-2026-20316, affects FMC releases through 7.0.9. Static credentials embedded in the web interface allow an unauthenticated attacker to enter a low-privileged account and access sensitive information.

Its CVSS score is only 5.3, but that rating does not reflect its value within an exploit chain. Attackers used it alongside CVE-2026-20079, demonstrating how a lower-severity credential weakness can help unlock a critical execution path.

CVE-2026-20316 entered KEV on July 29, 2026, with an August 1 federal remediation deadline. It is recorded as having been used in ransomware campaigns.

Cisco Talos associated the activity with UAT-12197, UAT-11823, and UAT-11988, clusters that include state-sponsored operators and ransomware groups. Intruders used built-in FMC functions for reconnaissance, deployed tunneling tools, harvested credentials, and, in some cases, installed Qilin ransomware encryptors.

Investigators should search for /var/tmp/license.tmp, tunneling utilities, credential theft activity, and Qilin-related deployment traces. A Linux implant named timezone_check, recovered from compromised appliances, was identified as a Cyclops Blink variant. Cyclops Blink has previously been associated with Sandworm.

Cisco disclosed six additional FMC vulnerabilities on September 16, including issues involving sftunnel, which FMC uses to communicate with managed firewalls. Their identifiers, affected releases, severity scores, and remediation details are not known.

Cisco ISE authentication bypass gives attackers root access

Cisco published its advisory for CVE-2026-76460 on September 16, 2026. The CVSS 10.0 vulnerability affects Cisco Identity Services Engine and ISE Passive Identity Connector regardless of device configuration.

The affected versions identified by NVD are ISE 3.1.0 and ISE-PIC 3.1.0. Cisco’s broader fixed-release table shows the patches required across supported branches:

Release branch	First fixed release
3.1	3.1 Patch 12
3.2	3.2 Patch 11
3.3	3.3 Patch 12
3.4	3.4 Patch 7
3.5	3.5 Patch 4

ISE 3.0 has reached End of Software Maintenance. Installations still using that branch should migrate to a supported, fixed release.

The vulnerability results from inadequate authentication on an API endpoint. A remote attacker without credentials can submit a crafted request, bypass the web management interface, and potentially execute commands with root privileges.

Cisco discovered the issue while resolving a Technical Assistance Center case and has confirmed active exploitation. CISA added it to KEV on September 16 and gave federal agencies until September 19 to remediate it.

There is no complete workaround. Cisco recommends upgrading and, until that can be done, using infrastructure access control lists to permit only required management and control-plane traffic.

Administrators should review ise-kong/access.log for suspicious usernames. Cisco provides this example:

admin#show logging application ise-kong/access.log | include dummyuser

In distributed installations, every node must be checked. Additional API gateway logs can be collected through a support bundle and examined under:

./ise/logs/apigateway/access.log..gz

Local evidence may be incomplete because root access permits attackers to delete or alter logs. Defenders should correlate appliance data with independent firewall, identity, and egress telemetry, particularly unexpected uploads to external addresses or downloads from malicious infrastructure.

Cisco recommends re-imaging affected nodes and restoring configuration backups when compromise is suspected.

SonicWall and Check Point face exploitable chains and urgent deadlines

SonicWall confirmed exploitation of two vulnerabilities chained against SMA 1000 appliances.

CVE-2026-83548 is a CVSS 10.0 pre-authentication server-side request forgery in the Appliance Work Place interface. It provides an unintended route to sensitive functions without requiring credentials.

CVE-2026-83549 is a CVSS 7.8 operating-system command injection in the Appliance Management Console. It normally requires an authenticated remote administrator, but chaining it with the SSRF flaw can produce unauthenticated remote code execution.

The affected products are:

• SMA8200V firmware before 12.4.3-03526;
• SMA6210 firmware before 12.4.3-03526;
• SMA7210 firmware before 12.4.3-03526.

Both vulnerabilities entered KEV on September 2, 2026, with a September 5 federal deadline. SonicWall advises customers to install the latest hotfix and investigate appliances for compromise. Compromised physical systems should be re-imaged, while virtual appliances should be redeployed rather than cleaned in place.

Check Point also disclosed three critical, remotely exploitable vulnerabilities. CVE-2026-85102 involves improper certificate-trust validation during VPN negotiation on Quantum Security Gateway. It can permit unauthenticated arbitrary code execution and carries a CVSS score of 9.8.

CISA added CVE-2026-85102 to KEV on September 22, with a September 25 remediation deadline.

CVE-2026-85103, another CVSS 9.8 issue, is a memory-corruption vulnerability capable of remote code execution. CVE-2026-91843, also scored 9.8, affects unauthenticated login processing on several management and logging servers and may enable code execution as root.

KEV inclusion and affected-version details are not known for the latter two flaws. The Dutch Nationaal Cyber Security Centrum has urged administrators to install Check Point’s security updates and warned that exploitation was imminent.

Not every critical network flaw is being exploited

CVE-2026-20212 affects specific Cisco Nexus 9000 switches containing a Silicon One ASIC. TCP ports 43210 and 43211 are exposed by default in the default Layer 3 VRF.

An unauthenticated attacker can connect to either port and submit crafted input that executes as root. Exploitation may also crash the S1HAL process and reload the device.

Affected product identifiers are:

N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808.

Administrators can use show module to identify installed hardware. Cisco recommends fixed software identified through Cisco Software Checker. As interim protection, organizations can restrict control-plane access with iACLs or deny traffic to local addresses on TCP ports 43210 and 43211. A temporary Live Protect shield is also available.

Cisco said it was not aware of public exploitation or malicious use. The flaw is therefore critical, but it should not be described as actively exploited.

Arista similarly disclosed two maximum-severity EOS issues on September 9: CVE-2026-73453 in P4Runtime on TCP port 9559 and CVE-2026-73456 in gNPSI. Both features are disabled by default, and Arista reported no known exploitation. Exact affected and fixed EOS releases are not known.

Patch consoles first, then verify the infrastructure behind them

CISA requires agencies addressing the KEV-listed vulnerabilities to apply vendor mitigations under BOD 26-04 and follow its Forensics Triage Requirements. Where mitigations are unavailable, the recorded action may require discontinuing the affected product.

The pattern also extends beyond individual vendors. In the preceding 90 days, KEV additions for Cisco and SonicWall included CVE-2026-76461 on September 14, CVE-2026-20349 on August 11, CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2008-4128 on July 13. CVE-2026-15409 and CVE-2026-15410 are associated with ransomware activity.

Defenders should prioritize externally reachable management interfaces, apply fixed releases, and restrict administrative access even after patching. They should also rotate exposed credentials and assess devices controlled by a compromised console.

Component inventories matter as well. The Linux CopyFail vulnerability, CVE-2026-31431, appears across 19 advisories from six vendors, including 14 Dell advisories covering VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.

Firmware must not be excluded. CVE-2026-20293, CVE-2026-33197, and CVE-2026-6485 track a UEFI Shell Secure Boot bypass affecting Cisco, AMI Aptio-based, and Insyde environments. AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes, although affected firmware builds and precise remediation versions are not known.

The immediate task is clear: patch the consoles that control the network, investigate them as potential breach points, and verify every downstream system whose credentials or configuration they could expose.