InfraTrust Report Finds Exploited Flaws in Infrastructure Management Systems
Summary
Eclypsium’s September report tracked 158 advisories covering 1,699 vulnerabilities and highlighted exploited flaws in infrastructure management systems, Linux kernel exposure across vendor advisories, and firmware weaknesses.
Key points
- InfraTrust tracked 158 advisories from 17 vendors between August 25 and September 17, covering 1,699 vulnerabilities; 71 could be exploited remotely without authentication.
- The report says high-value exploited flaws have appeared in administrative software for a second consecutive month.
- Cisco confirmed active exploitation of flaws affecting Firewall Management Center and Identity Services Engine; attackers reportedly chained FMC flaws and some deployed Qilin ransomware.
- SonicWall confirmed attacks exploiting two SMA 1000 vulnerabilities that can be chained for unauthenticated remote code execution; it recommends upgrading and investigating affected systems.
- The Linux kernel CopyFail vulnerability appeared in 19 advisories from six vendors, creating multiple remediation tasks across affected products.
- A UEFI Shell Secure Boot bypass affected Cisco, AMI Aptio-based systems, and Insyde products; several vendors released or announced fixes.
Article Details
- Publisher
- Eclypsium
- Report Period
- 2026-08-25 to 2026-09-17
- Scope
- Infrastructure security advisories affecting network devices, servers, firmware, chips, and other infrastructure.
- Sample Size
- 158 advisories across 17 vendors, covering 1,699 vulnerabilities.
- Key Statistics
- 42 advisories were rated critical.
- Eight vulnerabilities had a maximum CVSS score of 10.0.
- 71 vulnerabilities could be exploited remotely without authentication.
- Five advisories included vulnerabilities that were later added to CISA's KEV catalog.
- CVE-2026-31431 appeared in 19 advisories from six vendors.
- Recommendations
- Patch, monitor, and harden infrastructure management platforms.
- Restrict access to Cisco ISE appliances using infrastructure access control lists to prevent remote exploitation.
- For affected SonicWall SMA 1000 systems, install the latest hotfix, investigate for compromise, and re-image physical appliances or redeploy virtual ones rather than cleaning compromised installations in place.
- Install security updates for the Check Point vulnerabilities.
MITRE ATT&CK
T1003 · OS Credential DumpingAttackers harvested credentials from compromised systems.T1486 · Data Encrypted for ImpactSome attackers deployed Qilin ransomware encryptors.T1572 · Protocol TunnelingAttackers deployed tunneling utilities during the FMC attacks.T1592 · Gather Victim Host InformationAttackers used compromised FMC appliances for reconnaissance.
CVE
CVE-2026-20079One of the most serious vulnerabilities highlighted in the report is CVE-2026-20079, a maximum-severity Cisco Secure Firewall Management Center (FMC) authentication bypass.CVE-2026-20293The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde.CVE-2026-20316indicators of compromise that were also associated with attacks exploiting another FMC vulnerability, CVE-2026-20316.CVE-2026-31431InfraTrust found that CVE-2026-31431, a Linux kernel privilege escalation vulnerability dubbed “CopyFail” and added to CISA’s KEV catalog in May, now appears in 19 separate security advisories from six vendors.CVE-2026-33197The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde.CVE-2026-6485The disclosure resulted in three vulnerabilities tracked as CVE-2026-20293 for Cisco, CVE-2026-33197 for AMI Aptio-based systems, and CVE-2026-6485 for Insyde.CVE-2026-76460One of them, CVE-2026-76460, is an authentication bypass in an API that allows an unauthenticated remote attacker to execute commands as root.CVE-2026-83548CVE-2026-83548 is a CVSS 10.0 unauthenticated server-side request forgery vulnerability in the Appliance Work Place interface and CVE-2026-83549 is an OS command injection vulnerability in the Appliance ManagementCVE-2026-83549unauthenticated server-side request forgery vulnerability in the Appliance Work Place interface and CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console.CVE-2026-85102These include CVE-2026-85102, an authentication bypass that can lead to remote code execution in Remote Access and Site-to-Site VPN, and CVE-2026-85103, a memory corruption vulnerability that can also lead to remoteCVE-2026-85103bypass that can lead to remote code execution in Remote Access and Site-to-Site VPN, and CVE-2026-85103, a memory corruption vulnerability that can also lead to remote code execution.CVE-2026-91843A third vulnerability, CVE-2026-91843, is a a vulnerability in the unauthenticated login process that can allow attackers to execute code as root on several Check Point management and logging servers.
People
Threat Actors
SandwormThreat group previously associated with Cyclops Blink, of which the recovered timezone_check Linux implant was identified as a variant.UAT-11823Cisco Talos tracked this threat cluster as linked to the FMC attack activity.UAT-11988Cisco Talos tracked this threat cluster as linked to the FMC attack activity.UAT-12197Cisco Talos tracked this threat cluster as linked to the FMC attack activity.
Malware
Vendors
AMIThe report also highlights widespread supply-chain impact from the Linux kernel “CopyFail” flaw and firmware weaknesses affecting Cisco, AMI Aptio-based systems, and Insyde.Arista#CiscoCheck Pointin Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point products enabling remote code execution and full device control.CiscoAttackers are increasingly targeting infrastructure management systems, with exploited flaws in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point productsDellalso affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.InsydeThe report also highlights widespread supply-chain impact from the Linux kernel “CopyFail” flaw and firmware weaknesses affecting Cisco, AMI Aptio-based systems, and Insyde.SonicWallwith exploited flaws in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point products enabling remote code execution and full device control.
Products
AMI AptioThe report also highlights widespread supply-chain impact from the Linux kernel “CopyFail” flaw and firmware weaknesses affecting Cisco, AMI Aptio-based systems, and Insyde.Cisco Identity Services Enginemanagement systems, with exploited flaws in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point products enabling remote code execution and full deviceCisco Nexus 9000InfraTrust also highlighted CVE-2026-20212, a critical Cisco Nexus 9000 vulnerability that can allow unauthenticated attackers to gain root code execution through two debug ports that are reachable by default onCisco Secure Firewall Management Centerare increasingly targeting infrastructure management systems, with exploited flaws in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point products enablingDell SmartFabric Manageraffected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.EdgeConnect SD-WAN OrchestratorDuring the September reporting period, vulnerabilities also affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and AristaHPE Fabric ComposerDuring the September reporting period, vulnerabilities also affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and AristaNVIDIA Unified Fabric Managerperiod, vulnerabilities also affected HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.SonicWall NSM On-PremEdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Manager, Dell SmartFabric Manager, SonicWall NSM On-Prem, and Arista management interfaces.SonicWall SMA1000with exploited flaws in Cisco Secure Firewall Management Center, Cisco Identity Services Engine, SonicWall SMA 1000, and Check Point products enabling remote code execution and full device control.