As reported by BleepingComputer, Eclypsium's September InfraTrust Pulse report documents a troubling and accelerating trend: infrastructure management platforms — not the devices they manage — are becoming the primary target for both state-sponsored actors and ransomware operators. The numbers are stark. Over a three-week window, 158 advisories across 17 vendors produced 1,699 vulnerabilities, 42 of them critical, 71 remotely exploitable without authentication, and five landing on CISA's Known Exploited Vulnerabilities catalog.

Security Impact: As reported by BleepingComputer, Eclypsium's September InfraTrust Pulse report documents a troubling and accelerating trend: infrastructure management platforms — not the devices they manage — are becoming the primary target for both state-sponsored actors and ransomware operators.

But the headline statistic isn't the volume. It's the where. For the second consecutive month, the highest-value exploited flaws were in administrative software rather than in the infrastructure devices themselves. This is a structural shift in attacker economics, and it demands a structural shift in defensive posture.

Why Management Systems Are the Prize

Network devices — firewalls, switches, routers — are individually important. But a compromised management platform is a force multiplier. One FMC console can push configurations to hundreds of firewalls. One hypervisor management interface can control thousands of VMs. By pivoting upward to the control plane, attackers inherit the trust relationships and access scope of every managed asset simultaneously. This collapses the time between initial access and full infrastructure dominance from weeks to hours.

The Cisco FMC situation illustrates this perfectly. CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316 were chained together to achieve root command execution on firewall management appliances. Cisco Talos attributed the activity to three threat clusters — UAT-12197, UAT-11823, and UAT-11988 — spanning both nation-state and ransomware actors. The shared indicator /var/tmp/license.tmp appeared in advisories for both CVEs as early as July 29, yet Cisco initially stated it was unaware of malicious exploitation of CVE-2026-20079. That gap between indicator publication and exploitation confirmation is a recurring pattern defenders should note carefully.

Vulnerability Details

CVEProductCVSSSeverityAuth RequiredExploited in WildPatch Available
CVE-2026-20079Cisco Secure Firewall Management Center (FMC)10.0CriticalNoYes (confirmed Sept 9)Yes — hotfixes released
CVE-2026-20316Cisco Secure Firewall Management Center (FMC)High/CriticalHighLimitedYes (chained with CVE-2026-20079)Yes — hotfixes released

When a vendor publishes IOCs alongside a patch before confirming exploitation, treat that as exploitation-confirmed. The IOCs exist because someone found them — usually because attackers left them behind.

Who Is Most at Risk

Vulnerability Details
Large enterprises and MSSPs running centralized FMC deployments managing multiple firewalls — a single compromise cascades across the entire managed estate.
Government and defense sectors given the state-sponsored actor involvement flagged by Talos.
Organizations with internet-exposed management interfaces — FMC and similar platforms should never be reachable from the public internet without VPN or zero-trust access controls.
Environments with delayed patch cycles — the July-to-September window between hotfix availability and KEV listing gave defenders roughly six weeks, yet many organizations still lag.

Shield53 Recommendations

Immediate Actions

  • Patch all Cisco FMC appliances immediately using the hotfixes referenced in Cisco's advisory. Verify patch application across every FMC instance, including HA standby units.
  • Hunt for the IOC /var/tmp/license.tmp across FMC filesystems. If present, assume full compromise and initiate incident response — do not simply delete the file.
  • Review FMC access logs for unauthenticated HTTP requests to the web interface, especially from unexpected source IPs, dating back to at least July 2026.
  • Network-segment management interfaces. FMC, vCenter, UCS Manager, and equivalent platforms must live on isolated management networks with jump host access only. No direct internet exposure.

Strategic Hardening

  • Inventory your management plane as a distinct attack surface category. Track every platform that can push configuration to infrastructure assets and rate its exposure separately from the assets it manages.
  • Enforce MFA on all management consoles — not just VPN. The authentication bypass in CVE-2026-20079 shows that where MFA isn't supported, compensating controls like IP allowlisting and WAF rules become essential.
  • Monitor vendor advisory churn more aggressively. The InfraTrust report shows 158 advisories in three weeks. Organizations need automated advisory ingestion tied to their asset inventory, not manual review.
  • Treat IOC publication as exploitation confirmation. When a vendor releases indicators alongside a patch, adjust your risk model accordingly — don't wait for the KEV catalog entry.

The broader lesson from InfraTrust's September data is that the management plane is now the highest-leverage target in enterprise environments. Defenders who continue to prioritize hardening individual devices while leaving their management platforms under-protected are optimizing for the wrong threat model. The attackers have already moved up the stack. defenders need to follow.