Today’s Field Note

Two firewall management planes are on fire at once. Cisco confirmed CVE-2026-20079, a max-severity (CVSS 10.0) authentication bypass in Secure Firewall Management Center, is being actively exploited, while CISA reports ransomware crews have now folded the critical WatchGuard Firebox RCE into their operations. Both are the box that manages your other boxes, so a bypass here is a bypass everywhere downstream. Separately, THN documents BlueMoon, an undocumented Chrome and Windows exploit chain that four separate espionage clusters (starting with China-aligned APT31) were running within a single week, which tells you this kit leaked or was shared, not built four times over. Patch the perimeter management planes first, then get Chrome and Windows current.

Today’s Action

  • Patch Cisco Secure FMC for CVE-2026-20079 now, and pull management interfaces off any internet-facing path.
  • Apply the WatchGuard Firebox fix and hunt for ransomware precursors (new admin accounts, config exports) on any box that was exposed.
  • Force current Chrome and September Windows updates across the fleet to close the BlueMoon chain, prioritizing internet-facing and high-value users.
  • Review FMC and Firebox authentication logs for anomalous admin sessions and config changes going back several weeks, not just today.
  • Treat both firewall admin planes as potentially already touched: rotate credentials and validate rule sets against a known-good baseline.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Your firewall guards the door. Who’s guarding the firewall.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.