The Exploit Bulletin — Thursday, September 10, 2026: 5 issues require action
Thursday, September 10, 2026 — 5 issues require action. If you run none of the software below, you are done.
Affects: Cisco Secure Firewall Management Center · Cisco Security Cloud Control Firewall Management · WatchGuard Fireware OS · Google Chrome desktop · Chromium-based browsers including Microsoft Edge and Opera · Redis (internet-exposed, no authentication) · Redis instances reachable on TCP/6379 that accept commands
1. Unauthenticated authentication bypass to root via crafted HTTP requests in Cisco Secure Firewall Management Center (CVE-2026-20079)
CISA KEV (due 2026-09-12) · REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
CISA added this flaw to KEV on 2026-09-09 with a remediation deadline of 2026-09-12 as Cisco Talos reports ongoing exploitation of FMC and a Metasploit module is public; an unpatched FMC whose management interface is reachable gives an attacker root on the system that manages your firewalls.
An improper system process created at boot time lets a remote attacker with no credentials send crafted HTTP requests to the FMC web interface, bypass authentication, and execute scripts and commands that yield root access to the underlying operating system. Cisco Security Cloud Control (SCC) Firewall Management is affected as well.
Affected: Cisco Secure Firewall Management Center (FMC) 7.0.0; Cisco Secure Firewall Management Center (FMC) 7.0.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1.1; Cisco Secure Firewall Management Center (FMC) 7.0.2; Cisco Secure Firewall Management Center (FMC) 7.0.2.1; Cisco Secure Firewall Management Center (FMC) 7.0.3; Cisco Secure Firewall Management Center (FMC) 7.1.0; Cisco Secure Firewall Management Center (FMC) 7.1.0.1; Cisco Secure Firewall Management Center (FMC) 7.2.0; Cisco Security Cloud Control (SCC) Firewall Management
How to Test: Check the installed FMC software version: releases 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.0.2.1, 7.0.3, 7.1.0, 7.1.0.1 and 7.2.0 are listed as affected, and the Canadian Centre for Cyber Security advisory treats all FMC and SCC Firewall Management versions as in scope, so any release not carrying the fix for Cisco bug IDs CSCwr96008/CSCwt95974 should be considered vulnerable. Determine whether the FMC management web interface is reachable from the internet. Review web interface access logs for unexpected unauthenticated HTTP requests and inspect the appliance for unexpected script or command execution as root, unknown accounts, and unexplained configuration changes; CISA's KEV entry directs organizations to its Forensics Triage Requirements for compromised devices.
How to Patch: Upgrade FMC to a release containing the fix tracked under Cisco bug IDs CSCwr96008 and CSCwt95974 in advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2; Cisco states there are no workarounds. Until the upgrade is applied, remove public internet access from the FMC management interface, which Cisco notes reduces the attack surface.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Cisco Talos: active exploitation of Cisco Secure Firewall Management Center vulnerabilities (2026-09-09) · BleepingComputer: Cisco confirms CVE-2026-20079 exploited in attacks · CISA: added to KEV catalog 2026-09-09
2. Unauthenticated out-of-bounds write in WatchGuard Fireware iked gives remote code execution on Firebox (CVE-2025-14733)
CISA KEV (due 2025-12-26) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.3
CISA updated its catalog entry today to record ransomware use of this Firebox flaw, as reported by BleepingComputer on 2026-09-10, so an unpatched appliance with IKEv2 VPN exposed is a direct ransomware entry point.
An out-of-bounds write in the iked process of WatchGuard Fireware OS lets a remote, unauthenticated attacker run arbitrary code on the appliance. It affects mobile user VPN with IKEv2 and branch office VPN with IKEv2 to a dynamic gateway peer, and a device whose IKEv2 configurations were deleted can remain vulnerable if a branch office VPN to a static gateway peer is still configured. WatchGuard has observed post-exploitation theft of the device configuration and the local management user database.
Affected: WatchGuard Fireware OS >= 2025.1 < 2025.1.4; WatchGuard Fireware OS >= 12.0 < 12.11.6; WatchGuard Fireware OS >= 11.10.2 <= 11.12.4+541730; WatchGuard Fireware OS (T15/T35) >= 12.0 < 12.5.15; WatchGuard Fireware OS (FIPS) >= 12.0 < 12.3.1+728352
How to Test: Check the running Fireware OS version in Fireware Web UI / System Manager against the affected ranges above, and confirm whether any IKEv2 mobile user VPN or branch office VPN (including a static-peer BOVPN left behind after deleting IKEv2 configs) is configured. For compromise checks, set iked diagnostic logging to Info and look for IKE_AUTH request log lines with an abnormally large IDi payload (greater than 100 bytes), and for outbound transfers of the active configuration file or a gzip archive containing the configuration plus the local management user database to the same IP address the connection originated from; where exploitation is suspected, rotate all secrets stored on the Firebox.
How to Patch: Upgrade Fireware OS to 2025.1.4, 12.11.6, 12.5.15 (T15/T35) or 12.3.1+728352 (FIPS), or to any release above 11.12.4+541730 if still on the 11.x branch. If the upgrade cannot be scheduled immediately, remove or restrict internet-facing IKEv2 VPN configurations (including branch office VPNs to static gateway peers on devices that previously used IKEv2) and limit IKE reachability to known peer addresses.
Evidence: CISA KEV · VulnCheck KEV · Vendor confirmed · CISA SSVC: active · BleepingComputer (2026-09-10): CISA confirms ransomware gangs exploiting the WatchGuard Firebox flaw · Horizon3: active exploitation of the Fireware IKEv2 out-of-bounds write
3. Out-of-bounds write in Chromium V8 allows code execution from a crafted web page (CVE-2026-87491)
CISA KEV (due 2026-09-23) · REMOTE CODE EXECUTION · HIGH · CVSS 8.8
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-09 alongside Volexity's report of spear-phishing chains using it, so any fleet still on a pre-153 Chrome build can be compromised by a single visited page.
An out-of-bounds write in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page. Reporting describes it being chained with a Windows privilege escalation to escape the sandbox and gain full code execution on the host.
Affected: Google Chrome desktop < 153.0.8010.36 (Canadian Cyber Centre cites prior to 153.0.8010.37); Chromium-based browsers including Microsoft Edge and Opera that embed the affected V8
How to Test: Open chrome://settings/help (or Edge's About page) and confirm the build is at or above 153.0.8010.36; in managed fleets, inventory browser versions via your endpoint management console. For compromise triage, review proxy and email gateway logs for spear-phishing links matching the activity Volexity describes in its 2026-09-09 write-up and check affected hosts for the paired Windows privilege escalation activity.
How to Patch: Update Chrome to 153.0.8010.36/153.0.8010.37 or later on all desktop platforms and relaunch the browser so the new binary is loaded; apply the corresponding Chromium updates for Microsoft Edge, Opera and other embedders as soon as those vendors publish them, and enforce the minimum version through browser management policy.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA adds CVE-2026-87491 to the Known Exploited Vulnerabilities catalog · Canadian Centre for Cyber Security AV26-904: Google aware an exploit exists in the wild · Volexity: Chinese threat actors chain 0-day exploits in Chrome and Windows
4. Hard-coded low-privilege credential in Cisco Secure FMC web interface enables unauthenticated login and chained privilege escalation (CVE-2026-20316)
CISA KEV (due 2026-08-01) · AUTHENTICATION BYPASS · HIGH · CVSS 5.3
Cisco Talos published a threat advisory on 2026-09-09 describing ongoing exploitation of two FMC vulnerabilities including this one, so any FMC still on an affected 7.0.x or 7.2.0.x build with a reachable management interface should be assumed to be a target for the credential-plus-bypass chain.
FMC ships with a static user account whose credentials let an unauthenticated remote attacker log in to the web interface and read sensitive data. Cisco rates the issue High rather than Medium because the foothold can be combined with other FMC vulnerabilities to elevate privileges, and Talos reports it being used alongside the CVE-2026-20079 authentication bypass.
Affected: Cisco Secure Firewall Management Center (FMC) 7.0.0; Cisco Secure Firewall Management Center (FMC) 7.0.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1; Cisco Secure Firewall Management Center (FMC) 7.0.1.1; Cisco Secure Firewall Management Center (FMC) 7.0.2; Cisco Secure Firewall Management Center (FMC) 7.0.2.1; Cisco Secure Firewall Management Center (FMC) 7.0.3; Cisco Secure Firewall Management Center (FMC) 7.0.4; Cisco Secure Firewall Management Center (FMC) 7.2.0; Cisco Secure Firewall Management Center (FMC) 7.2.0.1
How to Test: Check the FMC software version shown in the web interface: 7.0.0 through 7.0.4 and 7.2.0/7.2.0.1 are affected. Determine whether the FMC management interface is reachable from the internet, since Cisco notes that exposure drives the attack surface. Review FMC web-interface authentication logs for successful logins by low-privileged accounts you did not create or from unexpected source addresses, and compare against the indicators in the Talos advisory at blog.talosintelligence.com/fmc-ongoing-exploitation/ for follow-on activity tied to CVE-2026-20079.
How to Patch: Upgrade FMC to the fixed release Cisco has published for your train under advisory cisco-sa-fmc-static-cred-BET3Cjh (Cisco bug CSCwt95997); Cisco states there are no workarounds. Until the upgrade completes, remove public internet access from the FMC management interface, which Cisco identifies as reducing the attack surface.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · Cisco Talos (2026-09-09): active exploitation of Cisco Secure FMC vulnerabilities · BleepingComputer: Cisco confirms FMC flaws exploited in attacks
5. Rogue-replication botnet compromised 3,562 unauthenticated internet-facing servers (Redis)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
Hunt.io's parse of the attacker's own logs shows this is not theoretical volume: 22–26% of a 12,966-host internet sweep fell, and nearly three quarters of hosts already known to accept unauthenticated commands were taken over, with the operator's tooling live as recently as late June 2026 and the same Monero wallet traced back to February 2026 — every unauthenticated Redis on a public IP is on somebody's target list right now.
Hunt.io recovered a cryptomining operator's full working directory and parsed the campaign logs directly: 3,562 distinct Redis servers were compromised out of 12,966 targeted, using the SLAVEOF/replicaof rogue-replication technique to load attacker content, then cron injection to run XMRig. Victims ran everything from Redis 2.8.17 to 7.2.0 on old and current Linux, so the enabling weakness is not a version-specific bug but Redis exposed to the internet with no password or ACL — anyone who can reach port 6379 can issue administrative commands and obtain code execution as the Redis user. Secondary branches (AOF-based SSH authorized_keys injection, MongoDB db.eval() sandbox probing) returned nothing at scale, and a WordPress credential-spray-to-webshell chain was recovered but not quantified. There is no CVE and no vendor flaw to patch; the fix is configuration and network exposure.
Affected: Redis instances reachable on TCP/6379 without authentication; confirmed victims ran Redis 2.8.17 through 7.2.0 on Linux from EOL RHEL/CentOS 6 to current Ubuntu kernels.; MongoDB hosts with legacy db.eval() enabled (468 scriptable, 0 confirmed compromised).; WordPress sites targeted via credential spraying to webshell (not quantified).
How to Test: From outside your network run redis-cli -h <your-public-ip> ping and redis-cli -h <your-public-ip> info server — a PONG or version output without AUTH means you are in the exact target population; also scan your ranges for open 6379/16379. On each instance check CONFIG GET requirepass, CONFIG GET protected-mode, CONFIG GET bind, CONFIG GET dir/dbfilename (attackers repoint these at /var/spool/cron) and INFO replication for an unexpected master_host. For compromise: look for cron entries in /var/spool/cron/* and /etc/cron.d fetching remote scripts, unexpected keys in the Redis keyspace, entries appended to ~/.ssh/authorized_keys for the redis or root user, high-CPU miner processes (XMRig or renamed), and outbound connections to mining pools; Hunt.io lists indicators including the staging host 188.245.99.156 and an earlier kit at 194.48.248.105.
How to Mitigate: Set bind 127.0.0.1 (or a private address), keep protected-mode yes, set a long requirepass and per-application ACL users, and firewall 6379/16379 to explicit client IPs; never expose Redis through a public load balancer or 0.0.0.0. Disable or rename the dangerous administrative commands with rename-command (SLAVEOF/REPLICAOF, CONFIG, MODULE LOAD, DEBUG, EVAL) where your application does not need them, run Redis as an unprivileged user with no cron or SSH write access, and upgrade off end-of-life Redis and end-of-life host OSes. Any instance found reachable without auth should be rebuilt rather than cleaned: remove attacker cron jobs and SSH keys, rotate credentials and keys stored in the keyspace, and check for other footholds.
Evidence: Hunt.io: Redis cryptomining botnet compromised 3,562 servers, from the operator's own campaign logs
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
