CISA KEV additions: Cisco Secure Firewall Management Center and Oracle PeopleSoft exploitation
Executive summary
Two vulnerabilities that CISA has added to the Known Exploited Vulnerabilities catalog are assessed as actively exploited in public reporting: CVE-2026-20079, an authentication bypass in the Cisco Secure Firewall Management Center web interface, and CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools flaw in the Environment Management component. CISA's required-action due date for CVE-2026-20079 was 2026-09-12. This report describes public exploitation and vendor remediation guidance only; it makes no statement about any internal environment.
Technical analysis
CVE-2026-20079 affects Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management. The catalog entry describes an authentication bypass using an alternate path or channel that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Security news reporting states that Cisco has confirmed exploitation and describes three distinct threat clusters; the KEV record classifies known ransomware campaign use as Unknown, so the ransomware linkage reported in news coverage is retained as an unassessed public claim rather than an attribution. CVE-2026-35273 affects Oracle PeopleSoft Enterprise PeopleTools and is described by CISA as a missing authentication for critical function issue that could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools. Mandiant and Google Threat Intelligence Group describe CVE-2026-35273 as a critical remote code execution vulnerability in the Environment Management component and report an extortion campaign attributed to UNC6240 (ShinyHunters) against Oracle PeopleSoft application infrastructure, with observed activity between 2026-05-27 and 2026-06-09 that aligned with targeting of Environment Management Hub (PSEMHUB) endpoints. Both descriptions are retained; the divergence in vulnerability characterization between the catalog entry and the vendor research is recorded as an open analytic item.
IOCs
No public IOC is available.
CVEs and affected products
Authentication bypass using an alternate path or channel in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management that could allow an unauthenticated, remote attacker to bypass authentication and execute script files to obtain root access.
Missing authentication for critical function in Oracle PeopleSoft Enterprise PeopleTools that could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools; original research characterizes the same issue as a critical remote code execution vulnerability in the Environment Management component.
ATT&CK mapping
Exploit Public-Facing Application
Tactic: Initial Access
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.85
⚠️ CISA records known ransomware campaign use for CVE-2026-20079 as Unknown; the Qilin ransomware linkage reported in security news is retained as an unassessed public claim and is not promoted as an attribution.
⚠️ CISA describes CVE-2026-35273 as missing authentication for critical function while Mandiant describes it as a critical remote code execution vulnerability in the Environment Management component; both descriptions are recorded and the divergence is unresolved.
⚠️ Sigma and YARA artifacts are not included because the cited evidence provides no stable process, command-line, file, or memory observables; generating them would fabricate behavior.
⚠️ The published detection artifacts are tuning templates: index, table, and field names are deployment-specific and must be validated against the local logging schema before use.
⚠️ No internal exposure, compromise, or organizational impact is inferred; this report describes public exploitation of public technology only.
⚠️ General security news sources were used for corroboration and context only; authoritative catalog and original research sources carry the substantive claims.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
10 references
▼
Evidence is drawn from the authoritative CISA Known Exploited Vulnerabilities catalog entries for both CVEs, the CISA alert announcing the 2026-09-09 catalog additions, Mandiant/Google Threat Intelligence Group original research on the Oracle PeopleSoft campaign, and general security news reporting used only for corroboration and context. Every statement in this bundle is linked to a persisted source document identifier and canonical URL.
CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog on 2026-09-09 with a required action to apply mitigations in accordance with vendor instructions and a due date of 2026-09-12, recording known ransomware campaign use as Unknown.
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management contain an authentication bypass using an alternate path or channel that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
BleepingComputer reported that Cisco confirmed CVE-2026-20079, an authentication bypass in the Secure Firewall Management Center web interface, is exploited in attacks.
The Hacker News reported that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center vulnerabilities, and described credential theft and Qilin ransomware deployment claims.
CISA added CVE-2026-35273 to the Known Exploited Vulnerabilities catalog on 2026-06-12 for Oracle PeopleSoft Enterprise PeopleTools missing authentication for critical function, which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
Mandiant and Google Threat Intelligence Group identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure, with activity observed between 2026-05-27 and 2026-06-09 consistent with exploitation of CVE-2026-35273.
Mandiant reported that exploitation aligned with targeting of Oracle PeopleSoft Environment Management Hub (PSEMHUB) endpoints.
CISA published an alert on 2026-09-09 announcing additions of four known exploited vulnerabilities to the catalog, including the Cisco Secure Firewall Management Center authentication bypass.
The Hacker News reported a CVSS score of 10.0 for CVE-2026-20079.
Mandiant described CVE-2026-35273 as a critical remote code execution vulnerability in the PeopleSoft Environment Management component, while CISA describes the same vulnerability as missing authentication for critical function.