Three max-severity CVEs dropped in the same 24-hour window, and one of them is already being exploited by ransomware operators with a federal patching deadline tomorrow. GitLab, Cisco Firepower Management Center, and Check Point VPN gateways all need immediate attention - and a separate campaign proved that AI agents can now automate exploitation across hundreds of targets simultaneously.

In the News

GitLab Patches CVSS 10.0 Path Traversal - CVE-2026-85706

GitLab released emergency patches for CVE-2026-85706, a maximum-severity path traversal vulnerability affecting self-managed GitLab instances. The flaw allows unauthenticated attackers to traverse the file system and achieve remote code execution on the underlying server without any credentials.

The severity here extends beyond the individual server. GitLab instances host source code repositories, CI/CD pipeline configurations, secrets, and deployment credentials. A compromised GitLab server gives an attacker direct access to the software supply chain - the ability to inject malicious code into build pipelines, exfiltrate proprietary source code, or pivot into production environments using stored deployment keys.

GitLab.com (the SaaS offering) is not affected. The vulnerability is specific to self-managed deployments, which are common in enterprises with compliance requirements that prevent SaaS-hosted code repositories. Organizations running self-managed GitLab should treat this as a stop-everything-and-patch event.

What defenders should do: Patch all self-managed GitLab instances immediately. Audit CI/CD pipeline secrets and deployment keys for any instances that were internet-facing before the patch. Review GitLab access logs for anomalous file path requests that could indicate exploitation attempts. This maps to MITRE ATT&CK T1190 (Exploit Public-Facing Application) and T1195.002 (Compromise Software Supply Chain).

Cisco FMC Zero-Day Exploited by Qilin Ransomware and State-Sponsored Clusters

CVE-2026-20079 is a critical authentication bypass in Cisco Firepower Management Center (FMC) - the centralized management platform for Cisco’s Secure Firewall deployments. The flaw allows an unauthenticated attacker to bypass authentication on the FMC web interface and gain administrative control of the management plane.

What makes this particularly dangerous is the confirmed exploitation. Cisco Talos identified three distinct threat clusters actively leveraging CVE-2026-20079 for initial access: Qilin ransomware operators and at least two state-sponsored groups. CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of September 12 - tomorrow.

Compromising FMC gives an attacker control over firewall policy, VPN configurations, and network visibility. An attacker with FMC admin access can disable security policies, create VPN tunnels for persistent access, and suppress alerting - effectively blinding the defender while maintaining their own access. This is not a theoretical concern; the Qilin group is using it operationally for ransomware deployment.

What defenders should do: Apply the Cisco security advisory patch immediately. If patching is not possible within hours, isolate FMC management interfaces from all untrusted networks - FMC should never be internet-facing, but many environments expose it inadvertently. Review Talos-published IOCs and hunt for indicators of compromise in FMC logs and connected Secure Firewall telemetry. Enforce multi-factor authentication on all FMC admin accounts as a compensating control. This maps to MITRE ATT&CK T1190 and T1556 (Modify Authentication Process).

Check Point VPN Gateways: Dual CVSS 9.8 Unauthenticated RCE

Check Point disclosed two critical vulnerabilities in its VPN gateway products - CVE-2026-85102 and CVE-2026-85103 - both rated CVSS 9.8. The flaws reside in the certificate-handling implementation and allow unauthenticated remote code execution against internet-facing VPN gateways.

Two unauthenticated RCE vulnerabilities in a single patch cycle for a perimeter security device is a significant exposure event. Check Point VPN gateways are deployed at the network edge, directly internet-facing by design. Any delay in patching leaves the organization’s primary remote access infrastructure vulnerable to complete compromise without any credential requirement.

No in-the-wild exploitation has been reported yet, but the combination of internet-facing deployment, unauthenticated access, and remote code execution means weaponization timelines will be short. Defenders should treat this as a race condition between patching and exploit development.

What defenders should do: Patch all Check Point VPN gateways immediately. If patching requires a maintenance window, implement network-level access controls (IP allowlisting) on VPN management and authentication interfaces as an interim measure. Monitor for anomalous certificate-related traffic to VPN endpoints. This maps to MITRE ATT&CK T1190.

AI Agents Automated Exploitation Across 395 Organizations

A Russian-speaking threat actor deployed hundreds of AI agents to automate the exploitation of known PaperCut vulnerabilities across 395 organizations globally. This is the first confirmed large-scale campaign where AI agents autonomously identified targets, validated vulnerabilities, tested exploits, and deployed payloads - without per-target human intervention.

The operational significance is the scale multiplier. Traditional vulnerability exploitation campaigns require human operators to adapt exploits to each target environment. AI agents removed that bottleneck, enabling near-simultaneous exploitation across hundreds of organizations. The campaign targeted PaperCut print management servers - a common but often unpatched component in enterprise environments.

This campaign validates what the security community has been anticipating: AI does not need to discover novel zero-days to be operationally transformative. Automating the exploitation of known, patched vulnerabilities against the long tail of unpatched systems is sufficient to generate mass compromise at speeds that overwhelm manual SOC triage.

What defenders should do: Ensure PaperCut servers are patched and segmented from critical infrastructure. More broadly, this campaign reinforces the need for automated detection and response capabilities - AI-speed attacks require AI-speed defenses. Behavioral analytics that detect post-exploitation lateral movement patterns are more durable than signature-based detection against AI-generated payload variants. This maps to MITRE ATT&CK T1190 and T1059 (Command and Scripting Interpreter).

Defender Action Items

  • GitLab CVE-2026-85706: Patch all self-managed instances immediately. Audit CI/CD secrets on any instance that was internet-facing before patching. Search GitLab logs for path traversal patterns in file access requests.
  • Cisco FMC CVE-2026-20079: Apply the Cisco security advisory patch before the September 12 KEV deadline. Isolate FMC management interfaces if patching is delayed. Hunt for Talos-published IOCs across FMC and Secure Firewall logs. Enforce MFA on all FMC admin accounts.
  • Check Point VPN CVE-2026-85102 and CVE-2026-85103: Patch all internet-facing Check Point VPN gateways. Implement IP allowlisting on VPN management interfaces as a compensating control during patch deployment.
  • PaperCut: Verify PaperCut servers are patched and network-segmented. Review print server logs for anomalous outbound connections indicating compromise.
  • IDScan breach (third-party risk): If your organization uses IDScan or similar KYC/identity verification providers, initiate a third-party risk review. Verify what data was shared and whether your organization’s records are in scope.

Detection Queries

The following Splunk SPL query detects potential path traversal exploitation attempts against GitLab web servers by identifying HTTP requests containing directory traversal sequences in the URI path. Tune the index and sourcetype to match your environment. False positive rate is low - legitimate GitLab requests should never contain ../ sequences.

index=web sourcetype=gitlab_access OR sourcetype=nginx:access
| regex uri_path="(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%2e\./)"
| stats count by src_ip, uri_path, status, dest
| where count > 3
| sort -count
| table _time, src_ip, dest, uri_path, status, count

For Cisco FMC exploitation detection, search for authentication bypass indicators in FMC audit logs - specifically successful administrative actions from unauthenticated sessions or unexpected source IPs:

index=cisco sourcetype=cisco:fmc:audit
| search action=login OR action=policy_deploy OR action=config_change
| stats count by src_ip, user, action
| where user="admin" OR user="system"
| lookup known_admin_ips src_ip OUTPUT is_known
| where is_known!="true"
| sort -count

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.