Management platforms emerge as prime targets in infrastructure attacks, Eclypsium report finds

The administrative consoles that oversee enterprise infrastructure have become a focal point for attackers seeking to compromise networks at scale. Eclypsium's September InfraTrust Pulse report, which monitors security advisories across infrastructure vendors, documents a troubling pattern: adversaries are increasingly targeting the management platforms that control firewalls, switches, routers and other critical devices.

Between August 25 and September 17, the InfraTrust tracking effort identified 158 new security advisories spanning 17 vendors and covering 1,699 distinct vulnerabilities. Among these, 42 carried critical severity ratings, eight achieved a maximum CVSS score of 10.0, and 71 could be exploited remotely without requiring authentication. Five advisories described flaws that subsequently appeared on CISA's Known Exploited Vulnerabilities catalog.

The most striking finding concerns where the most dangerous flaws are concentrated. "This is the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software, so treat these platforms as high-value targets and patch, monitor, and harden them accordingly," the report states.

Cisco management platforms under active attack

Cisco Secure Firewall Management Center (FMC) has emerged as a major target. CVE-2026-20079, a maximum-severity authentication bypass in FMC, permits unauthenticated attackers to craft HTTP requests to the web interface and execute arbitrary scripts and commands with root privileges. Cisco confirmed on September 9 that this flaw was being actively exploited, with its Product Security Incident Response Team having detected the attacks in August. CISA added the vulnerability to its KEV catalog the same day.

The timeline reveals a more complex picture. BleepingComputer reported on July 29 that Cisco had already published hotfixes and indicators of compromise for CVE-2026-20079, which were also linked to exploitation of a second FMC vulnerability, CVE-2026-20316. At that earlier point, Cisco stated it had no evidence of malicious exploitation of CVE-2026-20079, despite publishing the same /var/tmp/license.tmp indicator for both flaws. Subsequent analysis confirmed that attackers chained these two vulnerabilities together in coordinated campaigns.

Cisco Talos attributed the activity to three tracked threat clusters: UAT-12197, UAT-11823, and UAT-11988, which encompass both state-sponsored actors and ransomware operations. The attackers leveraged built-in FMC tools for reconnaissance, deployed tunneling utilities, extracted credentials from compromised systems, and in certain instances deployed Qilin ransomware. Sophos Counter Threat Unit analyzed a Linux implant called "timezone_check" recovered from compromised FMC appliances and determined it was a variant of Cyclops Blink, malware previously linked to the Sandworm group.

On September 16, Cisco disclosed six additional FMC vulnerabilities, including flaws affecting the sftunnel connection mechanism that FMC uses to communicate with managed firewalls. The same day, Cisco released advisories for Cisco Identity Services Engine (ISE), another critical management platform, describing three vulnerabilities with maximum CVSS scores of 10.0.

CVE-2026-76460, an ISE authentication bypass in an API, allows unauthenticated remote attackers to execute commands as root. CISA added this flaw to the KEV catalog on the disclosure date because it was already being exploited. Cisco offers no workarounds but notes that restricting appliance access through infrastructure access control lists can prevent remote exploitation.

Management vulnerabilities span multiple vendors

The targeting of administrative platforms extends well beyond Cisco products. During September, critical flaws affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces. InfraTrust emphasizes the significance of this pattern: "None of those is a firewall, switch, router, or fabric. Each one is the console that configures them, holds their credentials, and provides a change-control path into all of them at once."

SonicWall disclosed two actively exploited vulnerabilities in its SMA 1000 platform that attackers chained together. CVE-2026-83548, a CVSS 10.0 unauthenticated server-side request forgery flaw in the Appliance Work Place interface, combined with CVE-2026-83549, an OS command injection vulnerability in the Appliance Management Console, enables unauthenticated remote code execution. CISA added both to its KEV catalog on September 2, and SonicWall confirmed active exploitation. The vendor recommends upgrading to the latest hotfix, investigating systems for compromise indicators, and re-imaging or redeploying appliances rather than attempting in-place remediation.

Check Point disclosed three critical, remotely exploitable vulnerabilities requiring no authentication. CVE-2026-85102 is an authentication bypass leading to remote code execution in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is a memory corruption flaw with similar impact. The Dutch Nationaal Cyber Security Centrum (NCSC) warned that exploitation was imminent and urged administrators to apply security updates. A third flaw, CVE-2026-91843, affects the unauthenticated login process on several Check Point management and logging servers, allowing root code execution.

Arista published 34 security advisories on September 9, including two maximum-severity vulnerabilities permitting unauthenticated remote code execution on EOS systems. CVE-2026-73453 affects the P4Runtime service on TCP port 9559, and CVE-2026-73456 affects gNPSI. Both features are disabled by default, and Arista reports no known exploitation. InfraTrust also highlighted CVE-2026-20212, a critical Cisco Nexus 9000 flaw allowing unauthenticated root code execution through two debug ports that are reachable by default on affected switches.

Supply-chain vulnerability creates cascading patch burden

A single Linux kernel vulnerability demonstrates how third-party component flaws propagate across the infrastructure ecosystem. CVE-2026-31431, a Linux kernel privilege escalation flaw dubbed "CopyFail" and added to CISA's KEV catalog in May, now appears across 19 separate security advisories from six vendors. Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published advisories for affected products, while Dell accounts for 14 advisories covering VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.

The fragmentation creates significant operational challenges. "One upstream defect created nineteen remediation tasks, each arriving on a different vendor schedule with a different advisory number," InfraTrust notes.

Firmware vulnerabilities persist as infrastructure weak point

Beyond management platforms and operating system components, firmware remains a persistent vulnerability vector. Eclypsium discovered a UEFI Shell Secure Boot bypass and disclosed it through CERT/CC. The flaw permits attackers with access to UEFI boot settings to launch an embedded UEFI Shell normally blocked during startup, allowing modification of Secure Boot settings in memory and execution of unsigned code before the operating system loads.

The discovery resulted in three tracked vulnerabilities: CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde. AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes for affected products.