September is not giving edge infrastructure and DevOps administrators a break. Following last week’s MikroTik RouterOS SSH issues, the past seven days delivered a fresh round of critical vulnerabilities across core network management systems and CI/CD pipelines. CISA added more than a dozen entries to the KEV catalog. The most dangerous pattern this week is direct attacks against management and orchestration layers: from an unauthenticated root bypass in Cisco Secure FMC, through Fortinet’s monthly bulletin addressing hardcoded JWT keys, to a CVSS 10.0 arbitrary file read in GitLab that saw immediate mass scanning. If you manage on-premise infrastructure, here is what needs review this Monday.
1. Cisco Secure Firewall Management Center: Unauthenticated Root Bypass (CVE-2026-20079)
The most dangerous network infrastructure vulnerability this week affects the web management interface of Cisco Secure Firewall Management Center (FMC). The issue stems from improper execution logic in a boot-time system process. An unauthenticated attacker sending specially crafted HTTP requests to the web interface can bypass authentication entirely and execute arbitrary commands and scripts as root on the underlying operating system.
Tracked as CVE-2026-20079, the flaw carries a critical severity score (CVSS 8.6–9.8 depending on deployment vector). CISA confirmed active in-the-wild exploitation and added the vulnerability to the KEV catalog with an aggressive patching deadline. The issue affects on-premise deployments of Cisco Secure FMC. Cisco released official security updates. There are no workarounds for this vulnerability — the only reliable mitigation is applying the patch or isolating the management interface from public access and restricting it strictly to trusted administrative subnets.
- Identifier: CVE-2026-20079
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active exploitation confirmed (CISA KEV)
- Affected Systems: Cisco Secure Firewall Management Center (on-premise)
- Mitigation: Upgrade to patched Cisco FMC releases, isolate web interface
- Source: Cisco PSIRT Advisory (cisco-sa-onprem-fmc-authbypass-5JPp45V2)
2. Fortinet September Advisory Bundle: Static JWT Key in FortiMonitor and Traffic Interception in FortiPAM
FortiGuard Labs published its monthly security bulletin containing 11 new advisories, including two critical flaws. The highest score (CVSS 9.6) was assigned to FG-IR-26-170 in the FortiMonitorOnSight web portal. A static cryptographic key hardcoded into the source code is used to sign JWT tokens, allowing an unauthenticated attacker to generate valid administrative tokens and take over the portal.
The second critical flaw is FG-IR-26-168 (CVSS 9.1) in the Fortinet Privileged Access Agent (FortiPAM) Chrome extension. Improper identity verification allows an attacker who tricks a user into visiting a malicious site to route all browser traffic through an attacker-controlled proxy server. The bundle also patches FortiSandbox (FG-IR-26-166, CVSS 8.9 — unauthenticated NAT rule modification and config leak) and FortiOS / FortiProxy (FG-IR-26-174, CVSS 7.3 — improper certificate validation in the Agentless ZTNA portal allowing Man-in-the-Middle attacks). In parallel, CISA added an older Fortinet heap overflow flaw (CVE-2025-25249) to the KEV register.
- Identifiers: FG-IR-26-170, FG-IR-26-168, FG-IR-26-166, FG-IR-26-174, CVE-2025-25249
- Base Scores: CVSS 9.6, 9.1, 8.9, 7.3
- Affected Systems: FortiMonitorOnSight, FortiPAM Chrome Extension, FortiSandbox, FortiOS / FortiProxy
- Mitigation: Deploy updated Fortinet software releases and update browser extensions
- Source: FortiGuard Labs PSIRT Advisories
3. GitLab: Unauthenticated Arbitrary File Read (CVE-2026-85706, CVSS 10.0)
In CI/CD environments, the top priority issue is a Path Traversal vulnerability in GitLab Community Edition and Enterprise Edition, assigned the maximum possible severity score — CVSS 10.0. The flaw allows an unauthenticated remote user to read arbitrary files from the underlying server running GitLab.
In practice, this enables exfiltration of database encryption keys (secrets.yml), registry access tokens, SSL certificates, and proprietary source code repositories. Security researchers reported initial scanning and automated config extraction attempts against exposed instances within 24 hours of technical disclosure. The vulnerability was added to CISA KEV on an emergency basis. GitLab released patches in versions 19.3.2 and 19.2.4.
- Identifier: CVE-2026-85706
- Base Score: CVSS 10.0 (Critical)
- Exploitation Status: Mass scanning in the wild, listed in CISA KEV
- Affected Systems: GitLab CE/EE prior to 19.3.2 and 19.2.4
- Mitigation: Upgrade GitLab instances immediately to the latest patched release
- Source: GitLab Security Release Notes
4. JFrog Artifactory: Exploit Chain Used for Backdoor Injection (CVE-2026-42016, CVE-2026-42018)
JFrog Artifactory package and artifact repositories became the target of an organized campaign leveraging two new vulnerabilities: CVE-2026-42016 (improper authorization) and CVE-2026-42018 (authentication flaws), recently added to CISA KEV alongside CVE-2026-82329.
Threat actors chain these flaws to bypass API access boundaries, inject malicious dependencies into private repositories, and swap legitimate build artifacts with backdoored variants. This attack vector poisons the software supply chain: downstream CI/CD pipelines automatically deploy tainted packages directly to production servers. JFrog released updated software versions for Self-Managed deployments.
- Identifiers: CVE-2026-42016, CVE-2026-42018, CVE-2026-82329
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active supply chain attacks, listed in CISA KEV
- Affected Systems: JFrog Artifactory Self-Managed
- Mitigation: Upgrade Artifactory to patched versions, audit artifact checksums
- Source: JFrog Security Advisories
5. Palo Alto Networks: PAN-OS Updates and GlobalProtect Agent Vulnerabilities
Palo Alto Networks rolled out its September patch batch for PAN-OS firewalls and GlobalProtect client software. Within PAN-OS, the update resolves CVE-2026-0310 (High severity), a buffer overflow in XML parsing logic within the administrative web interface.
Concurrently, multiple flaws were resolved in the GlobalProtect client. The most notable vector is CVE-2026-0298, which enables local code execution on endpoints through the Windows Pre-Logon Access Provider (PLAP) mechanism. The release also fixes buffer overflow vulnerabilities during tunnel connection and UDP negotiation (CVE-2026-0250, CVE-2026-0297) and a privilege escalation race condition on macOS (CVE-2026-0295).
- Identifiers: CVE-2026-0310, CVE-2026-0298, CVE-2026-0250, CVE-2026-0297, CVE-2026-0295
- Base Scores: Medium to High (CVSS 5.5–8.2)
- Affected Systems: PAN-OS and GlobalProtect client app on Windows / macOS
- Mitigation: Apply PAN-OS updates and distribute new GlobalProtect client packages
- Source: Palo Alto Networks Security Advisories
Action Items for Today
- Isolate Cisco FMC Management Interfaces: Verify that Cisco Secure FMC web panels are not exposed to the public Internet and plan immediate installation of the patch for CVE-2026-20079.
- Upgrade GitLab Servers to 19.3.2 or 19.2.4: Given the trivial nature of Path Traversal exploitation (CVSS 10.0) and active wide-scale scanning, unpatched instances risk immediate exfiltration of secrets and source code.
- Review Fortinet Deployments: Update FortiMonitorOnSight instances (hardcoded JWT key) and push updates for the Fortinet Privileged Access Agent browser extension.
- Audit JFrog Artifactory Repositories: Beyond applying the latest releases, inspect API access logs for anomalous behavior and verify publish checksums.
- Schedule GlobalProtect Client Rollout: Package and distribute the updated VPN client for Windows and macOS workstations.
