September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Product
Cisco Secure Firewall Management Center
- Mentions · 7d0
- Mentions · 30d1
- All mentions23
- First seenAug 11, 2026
- Last mentioned18d ago
Timeline
23 articles · newest firstInfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
Cisco security advisory (AV26-932)
Cisco September 2026 updates fix flaws in ASA, FTD, FMC, ISE, and Nexus Dashboard; CISA added actively exploited CVE-2026-76460 to KEV.
72
Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
Cisco patches dozens of critical flaws in FMC, ISE and Nexus Dashboard, including ISE bugs and an authentication bypass already exploited in the wild.
80
Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026
Cisco's September 2026 firewall hardening release fixes internally found ASA, FTD, and FMC flaws, two of which are actively exploited.
72
Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
Cisco fixed an unauthenticated Java deserialization RCE in FMC's External Database Access feature allowing root command execution via a TCP port.
58
Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability
Cisco patched an sftunnel flaw in Secure Firewall Management Center letting an authenticated remote attacker execute arbitrary commands as root.
38
Cisco Secure Firewall Management Center Software Vulnerabilities
Cisco fixed multiple Secure Firewall Management Center flaws enabling remote attackers to gain root access, download files, inject SQL, or cause DoS.
50
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Vulnerabilities
Cisco fixed sftunnel flaws in Secure Firewall Management Center and Threat Defense allowing unauthenticated authentication bypass or denial of service.
38
ZDI-26-709: Cisco Secure Firewall Management Center CommandSinkRmi Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-20242, an unauthenticated deserialization flaw in Cisco Secure Firewall Management Center enabling remote code execution (CVSS 8.1).
45
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
48
Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware
Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.
90
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Three threat clusters including a Sandworm-linked group and Qilin ransomware operators exploit Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316.
84
Critical Cisco FMC Flaws Actively Exploited to Gain Root Access and Deploy Malware
Threat actors actively exploit Cisco FMC CVE-2026-20079 (CVSS 10.0) for root access, with clusters linked to Sandworm and Qilin ransomware.
87
Cisco FMC CVE-2026-20079 Actively Exploited
Cisco confirms active exploitation of CVE-2026-20079, a maximum-severity authentication bypass in Secure Firewall Management Center.
85
Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)
Cisco Talos confirms nation-state (Sandworm) and ransomware (Qilin) actors actively exploit CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center.
88
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
85
Organizations Warned of Cisco Secure FMC Exploitation
Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.
88
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.
85
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.
90
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
Cisco warns of a critical authentication bypass in Secure Firewall Management Center that lets unauthenticated attackers execute scripts and obtain root access.
78
Cisco Advance Notification for Publication of September 16, 2026, Security Advisories
Cisco will publish security advisories with fixed software on September 16, 2026, covering BroadWorks, ISE, Nexus Dashboard, ASA, FMC, FTD and ThousandEyes.
18
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Cisco warns of static low-privileged credentials in Secure Firewall Management Center's web interface, letting unauthenticated remote attackers log in and access sensitive data.
42
Related CVEs
by mentions- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
Appears with
- Ciscovendor · 22
- Sandwormthreat actor · 7
- Cyclops Blinkmalware · 6
- CISAvendor · 6
- UAT-12197threat actor · 6
- UAT-11823threat actor · 6
- UAT-11988threat actor · 6
- Ciscoorganization · 5
- Cisco Secure Firewall Threat Defenseproduct · 5
- Qilinthreat actor · 5
- Cisco Talosorganization · 5
- Cisco Identity Services Engineproduct · 4
- CISAorganization · 4
- Cisco Nexus Dashboardproduct · 3
- Cisco PSIRTorganization · 3
- Cyclops Blinkproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.