Cyber Threat Brief — September 10 2026
1. Cisco Secure FMC Auth Bypass ITW — CVE-2026-20079
TL;DR: Cisco confirmed August ITW abuse of CVE-2026-20079 (CVSS 10.0 unauth → root on Secure FMC via boot CGISESSID=csm_processes chain). CISA KEV added 2026-09-09; federal due 2026-09-12 + forensic triage. Talos tracks three clusters (webshell/JAR, Sandworm/Cyclops Blink, Qilin via related CVE-2026-20316).
What’s New:
- Cisco advisory v2.5 (2026-09-09) flips Exploitation section to active; CISA KEV same day (
forensicTriage=Yes) - Exploit path (VulnCheck/PoC):
Cookie: CGISESSID=csm_processes→ loginreport:snortrules→sf_action_id→ write/var/tmp/license.tmp(MAKESELF) viavalidateLicense→upgradeReadinessCallas root - Talos clusters: UAT-12197 (CSM Tomcat webroot webshell + JAR cred steal); UAT-11823 Sandworm (
license.tmpreverse shell → Cyclops Blink); UAT-11988 Qilin (static creds CVE-2026-20316 → recon/AV-kill/ransomware) - Public PoC + Nuclei template (
CGISESSID=csm_processesfingerprint); hotfixes only — no workaround; hardening release week of Sep 16 still pending
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
On-prem FMC trains 7.0 / 7.2 / 7.4 / 7.6 / 7.7 / 10.0 missing hotfix for CVE-2026-20079 (e.g. Cisco_Secure_FW_Mgmt_Center_Hotfix_P-10.0.1.1-2.sh.REL.tar for 10.0) | Vulnerable manager | T1190 | CMDB / Cisco Software Checker / inventory | Install matching train hotfix from Software Center before KEV due 2026-09-12; run forensic triage |
HTTP Cookie CGISESSID=csm_processes on FMC mgmt HTTPS (Nuclei/PoC fingerprint) | Auth-bypass session | T1078 / T1190 | FMC access/proxy logs, WAF | Alert any external CGISESSID=csm_processes; block + investigate — not a normal UI UUID session |
Hardcoded machine login username=report / password=snortrules to /login.cgi?logon=Continue with CGISESSID=csm_processes | Session upgrade | T1078.001 | FMC web logs | Hunt POSTs with report/snortrules; treat as CVE-2026-20079 exploit stage |
CLI: zgrep "package_info.*license" /var/log/messages* shows package_info.pl /var/tmp/license.tmp | Root RCE IOC | T1059 / T1068 | FMC /var/log/messages* (expert mode) | If hit: contact Cisco TAC before wipe; do not assume hotfix remediates prior compromise |
File /var/tmp/license.tmp written then executed via SF::UI::DataObjectLibrary::upgradeReadinessCall / pjb.cgi | Payload drop | T1105 / T1059 | FMC host FS audit, HTTP POST to /sajaxintf.cgi + /pjb.cgi | Hunt validateLicense writes + upgradeReadinessCall; remove implant per TAC |
New .jsp / .jar under CSM Tomcat webroot (Talos UAT-12197 webshell→JAR) | Webshell persistence | T1505.003 | FMC filesystem / Tomcat access logs | Inventory unexpected JSP/JAR in CSM webroot; pull hashes for intel |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | PARTIAL — Web or Application Server Spawning a Shell | parent_process_name tomcat/java/httpd → linux shells can catch post-exploit shell on instrumented hosts. Misses CGISESSID=csm_processes, report:snortrules, /var/tmp/license.tmp, package_info.pl. Rejected Web JSP Request via URL (Spring4Shell *.jsp?cmd= — not Talos FMC home.jsp pattern) |
| Elastic | None — verified search | 0 mapped CVE-2026-20079 / csm_processes / FMC license.tmp rules |
| Sigma | None — verified search | 0 ET-2026 rules for CVE-2026-20079; Cisco AAA/IOS-XE ET rules are different products |
Hunt hint: On every on-prem FMC: apply train hotfix for CVE-2026-20079; run zgrep "package_info.*license" /var/log/messages* looking for /var/tmp/license.tmp; proxy-hunt Cookie CGISESSID=csm_processes and POSTs with report/snortrules. KEV due 2026-09-12 with forensic triage.
Sources: Cisco SA cisco-sa-onprem-fmc-authbypass-5JPp45V2, Help Net Security Talos clusters, VulnCheck exploit analysis, CISA KEV alert 2026-09-09, Nuclei CVE-2026-20079
2. Fortinet PivotC2 via cw_acd — CVE-2025-25249
TL;DR: CVE-2025-25249 (heap overflow in FortiOS/FortiSwitchManager cw_acd) is on CISA KEV (due 2026-09-12). SOCRadar: ITW since ≥Jul 2026 delivering PivotC2 (Node.js FortiGate RAT) via CAPWAP UDP 5246 — ~30k scanned / 178 infected; US-heavy; Russian-speaking crimeware assessed.
What’s New:
- KEV + SecurityWeek 2026-09-10 amplify SOCRadar 2026-09-08 PivotC2 writeup
- Chain:
fortirun.bin→ reverse shell → Node.js one-liner → download XOR/pivot-keyed stage →/tmp/.i.js→ PivotC2 TLS C2 (interactive shell, SOCKS5, config/ENC credential harvest, auto-mode subnet scan) - Observed C2 / stager hosts:
146.103.99.177:8443(path/0c5b76709523),46.151.29.58 - Fixed: FortiOS ≥7.6.4 / 7.4.9 / 7.2.12 / 7.0.18; FortiSwitchManager ≥7.2.7 / 7.0.6; drop inbound UDP 5246–5249 if fabric/CAPWAP not required
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| FortiOS < 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18 or FortiSwitchManager < 7.2.7 / 7.0.6 (CVE-2025-25249 / FG-IR-25-084) | Vulnerable appliance | T1190 | FortiGate inventory / vuln scan | Upgrade to fixed builds before KEV due 2026-09-12; forensic triage exposed units |
Unauth crafted packets to CAPWAP Control UDP 5246 (cw_acd) for CVE-2025-25249 | Exploit delivery | T1190 / T1210 | Firewall/NetFlow, perimeter IDS | Alert unexpected UDP 5246 from Internet; local-in policy drop UDP 5246–5249 on external interfaces per Fortinet guidance |
Host file /tmp/.i.js on FortiGate | PivotC2 stager | T1059.007 / T1105 | FortiOS CLI fnsysctl ls | fnsysctl ls -la /tmp/.i.js; treat presence as compromise |
Process node executing /tmp/.i.js or unexpected Node on FortiGate | RAT runtime | T1059.007 | diagnose sys process list | grep node | Kill + preserve; hunt sibling /tmp artifacts |
Outbound TLS to 146.103.99.177 or 46.151.29.58 (PivotC2 C2) | C2 | T1071.001 | FortiGate sessions / firewall egress | diagnose sys session filter daddr 146.103.99.177 (and .58); block + rotate all VPN/admin/ENC secrets if hit |
Exploit binary name fortirun.bin / XOR key string pivot | Tooling constant | T1027 | Disk/memory strings, packet capture | Hunt filenames/strings; expect variants |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | PARTIAL — Web or Application Server Spawning a Shell | Includes parent node → linux shells — may catch interactive PivotC2 shell if Sysmon-for-Linux/EDR on appliance (rare). Misses CAPWAP UDP 5246, /tmp/.i.js, C2 IPs, fortirun.bin, CVE itself |
| Elastic | None — verified search | 0 CVE-2025-25249 / PivotC2 / cw_acd / CAPWAP 5246 mappings |
| Sigma | PARTIAL — FortiGate admin/policy rules (e.g. FortiGate - New Administrator Account Created) | Post-foothold config change only. 0 ET rules for CVE-2025-25249 / PivotC2 / /tmp/.i.js. Rejected older Forti ET (CVE-2022-42475 / CVE-2018-13379) — different bugs |
Hunt hint: Inventory FortiOS/FSM builds vs FG-IR-25-084 fixed list for CVE-2025-25249. On exposed boxes: fnsysctl ls -la /tmp/.i.js; session filters to 146.103.99.177 / 46.151.29.58; grep node process list. If IoCs hit — rotate SSL-VPN/LDAP/IPsec/admin credentials and rebuild. KEV due 2026-09-12.
Sources: SOCRadar PivotC2, SecurityWeek, Fortinet FG-IR-25-084, CISA KEV alert 2026-09-09
3. Citrix NetScaler Auth Bypass KEV — CVE-2026-19490
TL;DR: CVE-2026-19490 (CVSS 9.3 auth bypass via alternate path on Gateway/AAA vserver) added to CISA KEV 2026-09-09 with due 2026-09-12 + forensic triage. Citrix CTX696939 lists no mitigations — patch only. Previdian saw PoC-matching attempts from multiple countries after public PoC.
What’s New:
- Affects NetScaler ADC/Gateway 14.1 < 14.1-73.32, 13.1 < 13.1-63.21, and listed FIPS/NDcPP builds when configured as Gateway (SSL VPN/ICA/CVPN/RDP Proxy) or AAA vserver (SAML-action caveats by build)
- Companion DoS CVE-2026-19489 (SIP ALG on LSN) in same bulletin — secondary to auth bypass
- No Citrix advisory update acknowledging ITW yet; CISA KEV is the exploitation signal — treat as confirmed
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| NetScaler ADC/Gateway build < 14.1-73.32 or < 13.1-63.21 (FIPS: < 14.1-73.32 FIPS / < 13.1-37.277) — CVE-2026-19490 | Vulnerable appliance | T1190 | CMDB / show version / vuln scan | Upgrade to fixed builds before KEV due 2026-09-12; forensic triage internet-facing Gateway/AAA |
Config strings add authentication samlAction.* and/or add authentication vserver .* / add vpn vserver .* (CTX696939 precondition for CVE-2026-19490) | Exposure gate | N/A | show run / NITRO config export | Prioritize appliances matching Gateway/AAA (+ SAML where build requires); document non-Gateway boxes as lower urgency |
| Unauthenticated session/auth bypass traffic against Gateway/AAA VIP after PoC release window (≥2026-09-03 per Previdian) | Exploit attempt | T1190 | NetScaler AAA/VPN logs, WAF, IDP auth anomalies | Hunt successful logins without expected IdP assertions; correlate odd AAA accepts with source geo |
Sibling CVE-2026-19489 when add lsn group.*sipalg.* present | DoS exposure | T1499 | NetScaler config | Patch same build train; disable unused SIP ALG on LSN if not required |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | Existing Citrix stories/detections target CitrixBleed (CVE-2023-4966), CVE-2023-3519, ShareFile — not CVE-2026-19490 alternate-path auth bypass |
| Elastic | None — verified search | 0 CVE-2026-19490 / NetScaler SAML alternate-path rules |
| Sigma | None — verified search | ET Citrix rules are CVE-2019-19781 / CVE-2023-4966 / CVE-2020-8193 era — wrong bug class |
Hunt hint: Enumerate NetScaler builds vs 14.1-73.32 / 13.1-63.21. Confirm Gateway/AAA (+ SAML where applicable) via add vpn vserver / add authentication vserver / add authentication samlAction. Alert AAA successes lacking normal SAML IdP context. Patch — Citrix lists no workaround. KEV due 2026-09-12.
Sources: Citrix CTX696939, CISA KEV alert 2026-09-09, HKCERT bulletin 2026-09-10, Severity Daily
Status Updates
- CVE-2026-75650 (StyleSmuggler / Magento): KEV due tomorrow 2026-09-11 — VULN-39341 + credential rotation still mandatory. Sep 8
- N-central CVE-2026-86218: Same KEV due 2026-09-11 — HF4 build 2026.3.1.14 required. Sep 7
- CVE-2026-81963 / CVE-2026-85880 (Windows ITW LPEs): Remain KEV due 2026-09-22; continue Sep LCU + AppContainer→SYSTEM / Update Stack hunts. Sep 9
- CVE-2026-87491 (Chrome V8): Now on CISA KEV (added 2026-09-09, due 2026-09-23) — force ≥153.0.8010.36/.37. Sep 9
- PoisonedRefresh (F5 APM): Continue
/run/bigtlog.pipe+ HTTP 201+text/css hunts; patch ≠ clean. Sep 9 - CVE-2026-85046 (Chrome): Still KEV due Sep 18 — distinct from 87491. Sep 5
- ShieldCrash / FalconFlank / MikroTrick: No material change — keep watching / prior hunts. Sep 9 · Sep 5 · Sep 6