Eclypsium finds the month's exploited infrastructure flaws again in the management consoles

The two FMC flaws were used together. CVE-2026-20079 and CVE-2026-20316 were later confirmed to have been chained in attacks ^[10]. Once on the appliance, the operators ran reconnaissance with FMC's own built-in tooling, deployed tunneling utilities and harvested credentials from the compromised systems ^[12]. Sophos Counter Threat Unit recovered a Linux implant named timezone_check from compromised FMC appliances and identified it as a variant of Cyclops Blink, malware previously associated with Sandworm ^[13].

The dates on CVE-2026-20079 run in one direction. By July 29 Cisco had already updated the advisory with hot fixes and indicators of compromise that were also associated with attacks exploiting CVE-2026-20316 ^[8]. Cisco said at that point it was not aware of malicious exploitation of 20079, while publishing the same `/var/tmp/license.tmp` indicator for both ^[9]. Confirmation came on September 9, when Cisco said its Product Security Incident Response Team had become aware of the attacks in August ^[7]. Forty-two days separate the two statements ^[1].

Cisco disclosed six more FMC vulnerabilities on September 16, including flaws affecting the sftunnel connection FMC uses to communicate with managed firewalls ^[14].

The same reporting period brought vulnerabilities in HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem and Arista management interfaces ^[18]. The report does not record exploitation for that group. "None of those is a firewall, switch, router, or fabric," the report said ^[19]. "Each one is the console that configures them, holds their credentials, and provides a change-control path into all of them at once" ^[20].

Of the 158 advisories, 71 were remotely exploitable without authentication, about 45 percent ^[3][2]. Five produced entries on CISA's Known Exploited Vulnerabilities catalog, roughly 3 percent of the month's volume ^[4][3]. At least two of those five were authentication bypasses in a management platform, the FMC flaw and the ISE API flaw ^[4]. "This is the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software, so treat these platforms as high-value targets and patch, monitor, and harden them accordingly," the report said ^[5].