# Inside the New Attack Blueprint: Why Hackers Are Targeting Network Management Consoles

A new report from Eclypsium's InfraTrust Pulse reveals a disturbing trend in the cybersecurity landscape: attackers are no longer just targeting the network devices themselves—they're going straight for the management systems that control them. With 1,699 vulnerabilities tracked across 17 vendors in a single month, and several critical flaws already exploited before or shortly after disclosure, the message is clear: your administrative consoles are now ground zero for sophisticated hacking campaigns.

The September edition of InfraTrust Pulse highlights how threat actors are increasingly compromising the very platforms that configure, monitor, and hold the credentials for enterprise infrastructure. From Cisco firewalls and identity services to SonicWall appliances and Check Point VPNs, the most dangerous vulnerabilities of the reporting period were concentrated in the software that administrators use to manage their networks—not the devices themselves.

## The Shifting Battlefield: Management Systems as Prime Targets

Between August 25 and September 17, InfraTrust cataloged 158 new security advisories covering a staggering 1,699 vulnerabilities. Of those, 42 were rated critical, eight achieved the maximum CVSS score of 10.0, and 71 could be exploited remotely without any authentication whatsoever. Five of these advisories included vulnerabilities that made their way onto CISA's Known Exploited Vulnerabilities (KEV) catalog, which tracks flaws confirmed to be actively exploited in the wild.

But the most significant trend identified in the report isn't just the sheer volume of vulnerabilities—it's where these security holes are appearing. Management platforms that provide administrative control over network infrastructure are becoming the primary targets for sophisticated attackers.

"This is the second consecutive month the highest-value exploited flaws in infrastructure were in administrative software, so treat these platforms as high-value targets and patch, monitor, and harden them accordingly," the report warns.

The logic behind this strategy is clear: compromise the management console, and you gain full control over every device it manages, along with access to stored credentials and change-control systems. It's a single point of failure that can cascade into total network compromise.

## Cisco FMC Under Siege: The CVE-2026-20079 Story

One of the most serious vulnerabilities highlighted in the report is CVE-2026-20079, a maximum-severity authentication bypass in Cisco Secure Firewall Management Center (FMC). This flaw allows an unauthenticated attacker to send specially crafted HTTP requests to the FMC web interface and execute arbitrary scripts and commands as root on vulnerable devices.

The timeline reveals a complex attack chain that unfolded over months. Cisco confirmed active exploitation on September 9, updating its advisory after its Product Security Incident Response Team became aware of attacks dating back to August. CISA added the flaw to its KEV catalog the same day.

However, the full story is more concerning. BleepingComputer reported on July 29 that Cisco had already updated the CVE-2026-20079 advisory with hot fixes and indicators of compromise. Suspiciously, these were the same IOIs associated with attacks exploiting another FMC vulnerability, CVE-2026-20316. At that time, Cisco claimed it was not aware of malicious exploitation of CVE-2026-20079—despite publishing the identical `/var/tmp/license.tmp` indicator for both vulnerabilities.

The two flaws were later confirmed to have been chained together in real-world attacks. This kind of vulnerability chaining demonstrates the sophistication of modern threat actors, who are willing to invest time in discovering and combining multiple bugs to achieve full system compromise.

### The Threat Actors Behind the Attacks

Cisco Talos has linked the exploitation activity to three distinct threat clusters tracked as UAT-12197, UAT-11823, and UAT-11988. These groups include state-sponsored actors and ransomware gangs, indicating a diverse range of motivations behind the attacks.

The observed activities are alarming in their scope: - Using built-in FMC tools for network reconnaissance - Deploying tunneling utilities to establish persistent access - Harvesting credentials from compromised systems - Ultimately deploying Qilin ransomware encryptors

Additionally, Sophos Counter Threat Unit analyzed a Linux implant named "timezone_check" recovered from compromised FMC appliances and identified it as a variant of Cyclops Blink—malware previously associated with the notorious Sandworm threat group. This connection to Russian state-sponsored hacking suggests that nation-state actors are actively targeting network management infrastructure.

## Beyond Cisco: A Widespread Management Platform Crisis

The InfraTrust report makes clear that this trend extends far beyond Cisco. During the September reporting period, critical vulnerabilities also affected: - HPE Fabric Composer - EdgeConnect SD-WAN Orchestrator - NVIDIA Unified Fabric Manager - Dell SmartFabric Manager - SonicWall NSM On-Prem - Arista management interfaces

"None of those is a firewall, switch, router, or fabric," the report emphasizes. "Each one is the console that configures them, holds their credentials, and provides a change-control path into all of them at once."

### Cisco Identity Services Engine (ISE) Hit With Maximum-Severity Flaws

Cisco's Identity Services Engine, another critical management platform, was also targeted. On September 16, Cisco disclosed multiple ISE advisories, including three vulnerabilities with maximum CVSS scores of 10.0. One of these, CVE-2026-76460, is an authentication bypass in an API that allows an unauthenticated remote attacker to execute commands as root.

CISA added this flaw to its KEV catalog on the same day Cisco disclosed it, as it was already being actively exploited. Cisco warns there are no workarounds, although restricting access to the appliance using infrastructure access control lists can prevent remote exploitation until patches are applied.

### SonicWall SMA 1000: Chained Vulnerabilities Lead to RCE

The report also highlights two actively exploited SonicWall SMA 1000 vulnerabilities that were chained together in attacks. CVE-2026-83548 is a CVSS 10.0 unauthenticated server-side request forgery vulnerability in the Appliance Work Place interface, while CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console.

Together, these flaws achieve unauthenticated remote code execution. CISA added both vulnerabilities to its KEV catalog on September 2, and SonicWall has confirmed active exploitation. The vendor recommends upgrading to the latest hotfix and—critically—re-imaging physical appliances or redeploying virtual ones rather than attempting to clean compromised installations in place. This advice underscores the severity of the compromise: once these management systems are breached, they cannot be trusted again.

### Check Point's Critical VPN Vulnerabilities

Check Point also disclosed three critical, remotely exploitable vulnerabilities requiring no authentication. CVE-2026-85102 is an authentication bypass leading to remote code execution in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is a memory corruption vulnerability with similar impact. The Dutch Nationaal Cyber Security Centrum (NCSC) urged administrators to install security updates immediately, warning that exploitation was imminent.

A third vulnerability, CVE-2026-91843, affects the unauthenticated login process and can allow attackers to execute code as root on several Check Point management and logging servers. The pattern across all these vendors is unmistakable: management interfaces are the new attack surface of choice.

## The Supply Chain Problem: One Linux Flaw, 19 Advisories

The September report also demonstrates how supply-chain vulnerabilities in third-party components create massive patching headaches across infrastructure products. InfraTrust found that CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed "CopyFail" and added to CISA's KEV catalog in May, now appears in 19 separate security advisories from six vendors.

Arista, F5, Juniper, Extreme Networks, and HPE Aruba each published advisories affecting products containing the vulnerable component, while Dell accounts for 14 advisories covering products including VxRail, PowerFlex, ThinOS, PowerProtect, and Networking OS10.

"One upstream defect created nineteen remediation tasks, each arriving on a different vendor schedule with a different advisory number," the report explains. This fragmentation makes patching a logistical nightmare for security teams, who must track each vendor's unique advisory and remediation timeline.

## Secure Boot Bypass: Firmware-Level Threats

The report also mentions a UEFI Shell Secure Boot bypass discovered by Eclypsium and disclosed through CERT/CC. This vulnerability allows an attacker with access to UEFI boot settings to launch an embedded UEFI Shell that is normally blocked during startup. From there, the attacker can modify Secure Boot settings in memory and run unsigned code before the operating system even starts.

This type of firmware-level attack is particularly dangerous because it evades traditional endpoint detection and can persist even after OS reinstallation. The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde. AMI, Dell, Cisco, Lenovo, and Supermicro have released or announced fixes for affected products.

## Critical Infrastructure Protection: A Call to Action

The InfraTrust report serves as a wake-up call for organizations of all sizes. Network management systems are no longer just useful administrative tools—they're high-value targets for sophisticated attackers ranging from ransomware gangs to state-sponsored hacking groups.

For cybersecurity professionals, the implications are clear:

**Prioritize management platform security.** These systems should be treated as crown jewels, not afterthoughts. Implement strict access controls, monitor for anomalous activity, and ensure they're included in your patch management program from day one.

**Assume exploitation is possible.** The report shows that many of these vulnerabilities were exploited before or immediately after disclosure. Don't wait for patch availability—implement compensating controls and monitoring to detect potential compromise.

**Prepare for supply-chain complexity.** As the CopyFail example shows, a single upstream vulnerability can create dozens of patching tasks. Maintain a comprehensive asset inventory and track vendor advisories diligently.

**Plan for the worst case.** When vendors like SonicWall recommend re-imaging appliances rather than attempting cleanup, that advice reflects the reality that compromised management systems can't be trusted. Have business continuity plans in place for management platform breaches.

The attackers are already targeting your management consoles. The question is whether your organization is prepared to defend them.