The ransomware crew skipped Cisco's 10.0. It logged in with the 5.3 that CISA listed back in July

CISA added three exploited flaws to its Known Exploited Vulnerabilities catalog on 9 September 2026 and gave federal agencies until 12 September to deal with them:

Three days is short. What sits behind the listings is more interesting than the deadline.

The 10.0 was not the way in for everyone

Cisco's advisory for CVE-2026-20079 was first published on 4 March 2026. It describes an improper system process created at boot that lets an unauthenticated attacker send crafted HTTP requests, bypass authentication and run scripts as root. There are no workarounds. Cisco has since added a line: "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

Cisco Talos has published what that exploitation looks like, and it splits into three clusters:

• UAT-12197 used the bypass to drop a JSP web shell into the web root, then ran a JAR file to query the device's internal databases for credentials.
• UAT-11823 chained the bypass with a second flaw, deployed a Netcat reverse shell and proxy tooling, and finished with a variant of Cyclops Blink — a malware family Talos notes was previously attributed to Sandworm, the Russian state hacking group.
• UAT-11988, which Talos assesses "with high confidence" as consistent with Qilin ransomware affiliates, did not use the bypass at all.

It logged in instead through CVE-2026-20316, which Talos describes as a vulnerability that "allows a remote attacker to log in using a low-privileged account" — a hard-coded password, scored 5.3. From there it abused a legitimate utility on the appliance, package_info.pl, to run a malicious file dressed up as a licence.

That second flaw is not new to the catalog. CISA's own feed shows CVE-2026-20316 was added on 29 July 2026, with a federal deadline of 1 August. The same feed lists a third Management Center flaw, CVE-2026-20131, added in March. One management product, three catalog entries in six months.

So the arithmetic most teams use to triage runs backwards here. The 10.0 got this week's headline. The criminal crew went through a 5.3 that CISA had listed back in July. A working login does not need an exploit.

Fortinet's 7.3 gets the same three days as Cisco's 10.0

CVE-2025-25249 is a heap overflow in FortiOS and related products, fixed by Fortinet earlier this year and scored 7.3. Reporting on the campaign exploiting it puts the start at July 2026, attributes it to a Russian-speaking, financially motivated actor, and counts 178 devices infected with a post-exploitation backdoor called PivotC2.

It carries exactly the same deadline as the Cisco 10.0, and that is by design. Since June, CISA's deadlines no longer follow the score. We looked at the directive that changed that when WebLogic landed on the list: BOD 26-04 sets the clock from four questions — whether the asset is publicly exposed, whether the flaw is on the catalog, whether an attacker can automate every step, and whether it gives partial or total control. An internet-facing firewall with a known, automatable exploit gets three days whether its score is 7.3 or 10.

NetScaler's CVE-2026-19490 went the other way: when we covered it, nothing had been seen in the wild. It is on the list now.

The first instruction is not the patch

The part of BOD 26-04 that matters most for these three is the order of operations. For the three-day tier, CISA's implementation guidance sets out forensic triage in six time-boxed steps:

1. Scope the affected systems, within two hours.
2. Collect evidence, including volatile data such as memory — and "Do not alter or remediate systems prior to evidence/artifact collection when possible."
3. Patch, after the in-scope devices are identified and evidence is collected.
4. Contain, in a manner that "does not alert the threat actor."
5. Analyse for access, lateral movement, persistence and exfiltration, within 24 to 48 hours.
6. Decide and escalate within 48 to 72 hours, reporting confirmed compromise to CISA.

The reason is visible in the Cisco research. A web shell in the web root survives a hotfix. Credentials already queried out of the device stay stolen. An operator that logged in with a real account and ran the vendor's own tooling leaves little that a patch touches. Patching a management center that was compromised in August closes the door behind someone already inside — and wipes the memory that would have shown it.

Talos's write-up tells defenders to apply the hotfixes, and says Cisco will ship a "comprehensive hardening release" the week of 16 September. It does not offer post-compromise guidance. The federal directive does.

What to do

• Patch all three, but collect evidence first on anything that was internet-reachable. Memory before the reboot.
• On Cisco FMC, close CVE-2026-20316 as well as CVE-2026-20079, and CVE-2026-20131 if it is still open. Rotate every account on the appliance.
• Hunt for what Talos described: unexpected JSP files in the web root, unfamiliar JAR executions, unexplained use of package_info.pl, and outbound reverse shells.
• On FortiGate, look for PivotC2, and treat the device configuration as disclosed if you find it.
• Take the management plane off the internet. A firewall's console should not be reachable by the people the firewall exists to stop.

What is not established

• When each Cisco cluster first got in. Talos gives no start dates.
• How many organisations are affected by any of the three.
• How many hosts the Fortinet campaign scanned. Published figures disagree by a factor of ten.
• Whether the Cyclops Blink variant means Sandworm itself, or reuse of its tooling.
• What Cisco's hardening release changes.