Live Network Security Brief for August 5, 2026: Edge Devices, VPNs, and Segmentation

CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

CISA Known Exploited Vulnerabilities | July 29, 2026 | Known Exploited | Cisco Secure Firewall Management Center (FMC)

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

Why it matters: Cisco Secure Firewall Management Center (FMC) must be evaluated at the edge, management plane, firmware level, and independent logging path.

What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.

CISA remediation date: 2026-08-01. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Identify exposed management interfaces and confirm the exact firmware or software version.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CISA Known Exploited Vulnerabilities | July 27, 2026 | Known Exploited | Fortinet FortiOS

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Why it matters: Fortinet FortiOS commonly protects an internet edge or management boundary. Exposure there can affect remote access, traffic inspection, credentials, and the trust placed in downstream systems.

What to verify: Check the running firmware and model, restrict management access, compare configuration changes and new accounts, preserve independent logs, and rotate credentials if compromise cannot be excluded.

CISA remediation date: 2026-08-10. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Restrict administrative access to trusted networks and rotate credentials after suspected compromise.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-66747: Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every…

NIST National Vulnerability Database | August 5, 2026 | CRITICAL | CVSS 9.8

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones…

Why it matters: CVE-2026-66747 may be embedded across servers, containers, appliances, and administration hosts. Package installation alone does not prove that the corrected code is running.

What to verify: Compare distribution package versions, identify the loaded kernel or library, plan required service restarts or reboots, and validate workload health after the change.