InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
An Eclypsium InfraTrust report highlights a trend of attackers targeting network management systems like Cisco FMC and ISE. Key vulnerabilities include CVE-2026-20079, an actively exploited authentication bypass, and CVE-2026-76460, a critical flaw added to the KEV catalog. Attackers are chaining flaws, using built-in tools, and deploying malware like a Cyclops Blink variant and Qilin ransomware. The trend extends to management software from other vendors, posing a significant risk to enterprise infrastructure.
- Attackers are increasingly targeting enterprise network management systems.
- Cisco FMC authentication bypass CVE-2026-20079 is actively exploited.
- Cisco ISE flaw CVE-2026-76460 (CVSS 10.0) added to CISA KEV.
- Cyclops Blink malware variant found on compromised Cisco FMC appliances.
- Report highlights similar flaws in management software from HPE, NVIDIA, Dell.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 89% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — | ||
| CVE-2026-91843 | Unauthenticated stack overflow gives root RCE in Check Point login process | 9.8 | <1% | PoC |
From the original article
5 min read at bleepingcomputer.com
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.