Report Warns Attackers Are Targeting Network Management Systems

Attackers are increasingly targeting network management systems that control enterprise infrastructure, according to Eclypsium’s September InfraTrust Pulse report. Several critical flaws attracted attacks before or soon after vendors disclosed them.

Report Tracks 1,699 Vulnerabilities

Between August 25 and September 17, InfraTrust tracked 158 security advisories from 17 vendors. Together, they covered 1,699 vulnerabilities.

The report counted 42 critical advisories and eight flaws with a maximum CVSS score of 10.0. It also identified 71 vulnerabilities that attackers could exploit remotely without authentication.

Five advisories included flaws that later appeared in CISA’s Known Exploited Vulnerabilities catalog. However, the report’s central concern is where attackers are finding the most valuable weaknesses.

Network management systems can configure devices, hold credentials and push changes across an organization. As a result, access to one management console can give an attacker a path into many connected devices.

Cisco Management Platforms Face Active Attacks

The report highlights CVE-2026-20079, a maximum-severity authentication bypass in Cisco Secure Firewall Management Center. An unauthenticated attacker can send crafted requests to its web interface and run commands as root.

Cisco confirmed active exploitation on September 9. Investigators later found that attackers chained the flaw with another vulnerability, CVE-2026-20316.

Cisco Talos linked the activity to three threat clusters. Attackers used compromised systems for reconnaissance and credential theft. In some cases, they also deployed Qilin ransomware.

Cisco Identity Services Engine faced a separate actively exploited flaw. CVE-2026-76460 allows an unauthenticated remote attacker to execute commands as root through an API. Cisco says it has no workaround, although access controls can limit remote exposure.

Other Infrastructure Products Need Attention

The report also covers two SonicWall SMA 1000 flaws that attackers have chained to run code remotely. SonicWall recommends applying its latest hotfix and investigating affected systems for compromise.

Meanwhile, a Linux kernel flaw known as CopyFail has appeared in 19 advisories from six vendors. Each affected product requires its own remediation decision and schedule.

Finally, InfraTrust highlights a Secure Boot bypass involving the UEFI Shell. An attacker with access to UEFI boot settings could use it to run unsigned code before the operating system starts. Several vendors have released or announced fixes for affected products.