A CVSS 10.0 pre-authentication RCE in Cisco Secure Firewall Management Center is now actively exploited, with CISA ordering remediation by Friday. That alone would dominate the day, but two other stories deserve attention: WatchGuard Firebox entering ransomware kill chains, and four Chinese APT groups sharing a single Chrome zero-day exploit kit within one week.

In the News

Cisco FMC CVSS 10 Auth Bypass Now Exploited - CISA Orders Sept 12 Patch

CVE-2026-20079 is an unauthenticated remote code execution vulnerability in Cisco Secure Firewall Management Center (FMC) carrying a CVSS score of 10.0. The flaw allows an attacker with network access to the FMC web interface to execute arbitrary code without any credentials. Cisco Talos confirmed that attackers are chaining it with CVE-2026-20316, a separate privilege escalation vulnerability, to achieve root-level access on compromised FMC instances.

The hotfix has been available since March 2026. Despite six months of patch availability, exploitation began in early September and was confirmed by both Cisco Talos and CISA, which added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of September 12, 2026.

The operational consequence is severe: FMC is the centralized management plane for Cisco Secure Firewall (FTD) deployments. An attacker with root on FMC can push policy changes, deploy backdoors, or disable security controls across every firewall the instance manages. This is not a single-device compromise - it is a management-plane takeover.

What defenders should do: Apply the March hotfix immediately. Validate that FMC web interfaces are not exposed to untrusted networks. Segment management-plane traffic from production. Review FMC audit logs for anomalous authentication attempts and policy changes since early September. The MITRE ATT&CK techniques in play are T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

WatchGuard Firebox RCE Weaponized by Ransomware Operators

A WatchGuard Firebox remote code execution vulnerability, originally flagged by CISA in December 2025, has now been confirmed in active ransomware campaigns. BleepingComputer reports that ransomware operators are chaining the Firebox RCE with credential harvesting tools for lateral movement into SMB and mid-market networks. CISA re-flagged the flaw for federal patch enforcement after observing sustained exploitation through August and September 2026.

This follows a pattern that has become distressingly familiar: perimeter devices with known, patched vulnerabilities remain unpatched in production for months, then enter organized ransomware toolkits. WatchGuard Firebox is particularly prevalent in small-to-mid-sized business environments where dedicated security operations teams are rare and firmware update cycles are long.

What defenders should do: Verify WatchGuard firmware is current across all Firebox deployments. For organizations evaluating firewall platforms, this is a forcing function - the question is not just “is this patched?” but “does our vendor’s update lifecycle match our operational reality?” Network detection for anomalous outbound connections from firewall management interfaces should be in place regardless of vendor. MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1486 (Data Encrypted for Impact).

Four China APTs Shared One Chrome Zero-Day Kit in One Week

Google patched CVE-2026-87491, a V8 out-of-bounds write in the Chrome JavaScript engine, after The Record reported that four distinct Chinese state-sponsored groups - including APT31 and APT41 - exploited it within the same week. Researchers identified a shared exploit kit dubbed “BlueMoon” as the delivery mechanism. This is the seventh Chrome zero-day exploited in 2026.

The coordination is the story here. Four APT groups using an identical exploit kit within a one-week window indicates a centralized exploit development or procurement pipeline feeding multiple operational units. Browser-based initial access via memory corruption is not new, but the industrialized sharing of zero-day capability across groups accelerates the window between exploit development and mass deployment.

What defenders should do: Force Chrome updates across all managed endpoints immediately. For organizations with unmanaged browsers or BYOD, browser isolation and secure web gateway controls are the compensating layer. DNS-layer security blocks connections to exploit kit infrastructure before the payload delivers. MITRE ATT&CK: T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution).

Passkey-Themed Social Engineering Enables Identity Persistence via Graph API

Microsoft’s security team warns of an active campaign since May 2026 in which attackers social-engineer users into registering attacker-controlled authentication methods under the guise of “passkey setup.” Once a rogue auth method is registered on the victim’s Entra ID account, the attackers use Microsoft Graph API to automate exfiltration from SharePoint, OneDrive, and Exchange Online.

The technique is notable because it survives password resets. The attacker’s authentication method remains registered on the account regardless of credential rotation. Detection requires monitoring for authentication method registration events - specifically, new FIDO2 key or phone sign-in method additions - and correlating them with conditional access policy exceptions or anomalous Graph API call volumes.

What defenders should do: Audit authentication method registration policies in Entra ID. Restrict who can register new authentication methods and require administrator approval for FIDO2 key enrollment. Monitor Graph API activity for automated bulk file access patterns. MITRE ATT&CK: T1556.006 (Modify Authentication Process: Multi-Factor Authentication), T1114.002 (Email Collection: Remote Email Collection).

Defender Action Items

  • Cisco FMC (CVE-2026-20079): Apply the March 2026 hotfix before September 12. Confirm FMC web interfaces are isolated from untrusted networks. Audit FMC logs for anomalous activity since September 1.
  • WatchGuard Firebox: Verify firmware is patched to the latest version. Monitor for anomalous outbound connections from firewall management planes. Evaluate vendor patching lifecycle against operational needs.
  • Chrome (CVE-2026-87491): Force Chrome stable channel updates across all managed endpoints. Deploy browser isolation for unmanaged devices. Block known BlueMoon infrastructure at the DNS layer.
  • Passkey social engineering: Restrict authentication method registration in Entra ID. Require admin approval for new FIDO2 key enrollment. Alert on anomalous Graph API bulk file access patterns.
  • N-able N-central (CVE-2026-86218): Patch immediately. Reassess RMM vendor risk - five critical RCEs in five weeks is a supply-chain red flag.
  • Fortinet (CVE-2025-25249): Verify January 2026 patch is applied. Hunt for PivotC2 RAT indicators on any Fortinet appliance that was unpatched between January and now.

Detection Spotlight

The Cisco FMC exploitation chain (CVE-2026-20079 + CVE-2026-20316) targets the FMC web interface for initial access. The following Splunk SPL query detects anomalous authentication patterns against FMC management interfaces - specifically, successful access from IP addresses that have never previously authenticated to FMC, combined with rapid subsequent API calls indicative of automated exploitation.

index=cisco_fmc sourcetype="cisco:fmc:audit"
| eval auth_status=if(match(action, "(?i)login_success"), "success", "other")
| where auth_status="success"
| stats earliest(_time) as first_seen count as access_count dc(uri_path) as unique_endpoints by src_ip, user
| where first_seen > relative_time(now(), "-48h") AND access_count > 10 AND unique_endpoints > 5
| sort - access_count
| table src_ip, user, first_seen, access_count, unique_endpoints

This query surfaces IP addresses that first appeared in the last 48 hours and immediately generated high-volume, high-breadth API activity - a pattern consistent with automated exploitation rather than legitimate administrator access. Tune the access_count and unique_endpoints thresholds to your environment’s baseline. False positives may include new administrators or IP address changes from VPN reassignment - correlate with change management records.

For the passkey social engineering campaign, monitor Entra ID audit logs for authentication method registrations:

AuditLogs
| where OperationName == "User registered security info"
| extend MethodType = tostring(AdditionalDetails[0].value)
| where MethodType in ("Fido2", "PhoneSignIn", "Passkey")
| project TimeGenerated, UserPrincipalName, MethodType, IPAddress, Location
| join kind=leftanti (
    SigninLogs
    | where TimeGenerated > ago(90d)
    | distinct IPAddress
) on IPAddress
| sort by TimeGenerated desc

This KQL query flags security info registrations from IP addresses that have never appeared in the organization’s sign-in logs - a strong indicator of attacker-initiated enrollment from external infrastructure.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.