Remediation · CISA KEV additions: Cisco Secure Firewall Management Center and Oracle PeopleSoft exploitation

Immediate Containment

! Apply vendor mitigations for CVE-2026-20079 in accordance with Cisco instructions, or discontinue use of the affected management capability where mitigations are unavailable, as directed by the CISA required action.

! Apply Oracle remediation for CVE-2026-35273 in accordance with the Oracle security alert for the affected PeopleSoft Enterprise PeopleTools releases.

Exposure Reduction & Patching

🛡️ Restrict management-plane and administrative access for Cisco Secure Firewall Management Center to authorized administration paths.

🛡️ Restrict Oracle PeopleSoft Environment Management and administrative endpoints to authorized network paths and enforce upstream access controls.

📦 Confirm deployed FMC and Security Cloud Control Firewall Management versions against the Cisco advisory and apply the supported fixed release.

📦 Confirm the applied Oracle PeopleSoft Enterprise PeopleTools fix status against the Oracle security alert and apply supported updates.

Configuration & Credentials

⚙️ Verify that external access controls and logging cover the affected HTTP-facing services.

🔑 Rotate administrative credentials for affected management interfaces only after preserving authentication and administrative logs, because the catalog marks forensics triage as required for CVE-2026-20079.

Evidence Preservation

📁 Preserve management-plane, authentication, web, application, database, and system logs before rotation or remediation.

Verification & Rollback

✓ Confirm the deployed version against the vendor affected and fixed version guidance for each product.

✓ Confirm that management access and authentication logs show no unexplained activity during the reported exploitation windows.

↩️ Rollback: Follow the vendor supported upgrade and rollback procedure; do not deviate from vendor guidance for these management-plane products.