InfraTrust Report Warns Network Management Systems Under Attack

The September 2026 edition of the InfraTrust Pulse — a monthly infrastructure-vulnerability tracking report published by security vendor Eclypsium — documented 158 new security advisories across 17 vendors, covering 1,699 individual vulnerabilities. Of those, 42 advisories were rated critical, 8 vulnerabilities carried a maximum CVSS score of 10.0, and 71 were remotely exploitable without authentication. Five advisories involved flaws that CISA added to its Known Exploited Vulnerabilities (KEV) catalog during the reporting period.

The report's headline finding isn't a single incident — it's a pattern. According to Eclypsium, this is the second consecutive month in which the highest-value flaws actively exploited in the wild sat in administrative and management software, not in the routers, switches, or firewalls those consoles control.

The management plane, not the network gear, is the target

InfraTrust's framing is blunt: the systems drawing the most dangerous exploitation attempts aren't firewalls, switches, routers, or fabrics themselves — they're the consoles that configure those devices, hold their credentials, and can push a change fleet-wide. Compromising one management platform can hand an attacker centralized control over hundreds or thousands of downstream devices at once, which is exactly why these products are increasingly the first target rather than an afterthought.

Named products and flaws

Note: several of the vendor entries above are confirmed as named in InfraTrust's September reporting period but the specific CVE identifiers for each weren't itemized in the coverage reviewed for this article — treat those rows as "named, unconfirmed specifics" rather than fully sourced CVE detail.

Exploited before — or the day of — disclosure

The Cisco ISE flaw, CVE-2026-76460, is the report's clearest example of the pre-disclosure exploitation pattern it's tracking: CISA added it to the KEV catalog the same day Cisco published the advisory, indicating attackers were already using it in the wild by the time defenders had a patch to apply. Cisco has said there is no workaround for the ISE flaw, though restricting appliance access with infrastructure access control lists can block remote exploitation in the meantime.

This isn't new territory for InfraTrust. Its inaugural July 2026 report tracked 61 advisories across 14 vendors, including 26 remotely exploitable, unauthenticated vulnerabilities spanning firewalls, VPNs, switches, and load balancers — and already flagged centralized management tools such as Cisco FMC, Arista VeloCloud Orchestrator, Aruba SD-WAN Orchestrator, Check Point SmartConsole, and Fortinet's management tooling as recurring high-value targets.

Why management consoles are such attractive targets

Network management platforms are a force multiplier for attackers: they typically hold privileged, fleet-wide credentials, sit at a trust boundary between IT operations and the devices they administer, and — because they're built for centralized change control — can push a malicious configuration or backdoor to every device they manage in one action. A single unauthenticated RCE in a management console can be worth more to an attacker than dozens of flaws in individual edge devices.

Recommendations

InfraTrust's core recommendation is to prioritize patching by real-world exploitability and internet exposure rather than CVSS score alone, and to treat management consoles specifically as high-value assets requiring priority patching, monitoring, and hardening. For appliances confirmed compromised, the guidance is stricter than a routine patch cycle: SonicWall specifically recommends reimaging affected SMA 1000 appliances rather than attempting in-place remediation, since attackers with root access can plant persistence that survives a simple patch. General best practices echoed across the report include removing management interfaces from direct internet exposure, enforcing MFA and strict access control lists on administrative consoles, and auditing for unexpected configuration changes that could indicate an already-compromised management plane.

Why this matters for defenders

The takeaway for IT and security teams isn't a single CVE to patch — it's a shift in threat modeling. If the management console for your firewalls, VPN concentrators, or SD-WAN fabric is reachable from the internet, or even broadly reachable internally, it should be treated with the same urgency as a domain controller or identity provider, not scheduled into a routine quarterly patch window. InfraTrust's two-month trend suggests attackers already understand this asymmetry; the report's message is that defenders need to catch up.

Sources

• InfraTrust report warns network management systems under attack — BleepingComputer
• InfraTrust Pulse (Eclypsium)
• July 2026 InfraTrust Report Flags 26 Unauthenticated Vulnerabilities and Exploited SonicWall Flaws — GBHackers