Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: CISA’s latest KEV additions confirm active exploitation of MikroTik RouterOS flaws and Cisco FMC authentication bypass conditions, while Rapid7 tooling and ransomware-linked CVEs show how quickly exposed management planes become operational targets, according to Senserva. Patch order now has to follow exploitation evidence, not CVSS alone, because edge and management-plane exposure can outrun routine enterprise reporting.
NHIMG editorial — based on content published by Senserva: Two MikroTik RouterOS flaws added to CISA KEV and related exploitation updates
By the numbers:
- CVE-2026-20079 is a CVSS 10 authentication bypass with an EPSS of 0.76 and a KEV listing.
- CVE-2026-41940 carries a CVSS 9.8 score and an EPSS of 0.99, placing it among the most likely exploited flaws on the hot list.
- CVE-2026-86060 is a CVSS 9.8 RouterOS flaw added to CISA KEV, confirming active exploitation of edge devices.
Questions worth separating out
Q: What breaks when a firewall or router management plane is internet-facing?
A: When a management plane is internet-facing, the control boundary collapses from authenticated administration to public attack surface.
Q: Why do KEV-listed vulnerabilities deserve faster action than high-CVSS bugs?
A: KEV-listed flaws already have evidence of exploitation, which means attackers are actively prioritising them.
Q: What are the signs that privileged infrastructure access is poorly governed?
A: Common signs include unmanaged admin interfaces, inconsistent ownership of firewall or router consoles, direct internet exposure, and patch state that is tracked separately from privileged access records.
Practitioner guidance
- Prioritise KEV-listed management-plane flaws first Reorder remediation so confirmed in-the-wild exploitation beats CVSS-only triage, especially for firewall managers, VPN portals, and router admin surfaces.
- Inventory every edge device and admin console Build a current list of MikroTik, Cisco FMC, VPN, and other boundary systems, including owner, exposed interface, and patch status.
- Remove public access to management interfaces Restrict administrative endpoints to trusted networks or jump hosts and verify that no router or firewall management plane is directly internet-facing.
What's in the full analysis
Senserva's full article covers the operational detail this post intentionally leaves for the source:
- Exact CVE ranking logic combining CISA KEV, EPSS, and ransomware linkage for patch order
- Daily non-Microsoft exploited-CVE tracker behaviour and how it surfaces new KEV additions
- Free Microsoft Patch Tracker workflow for Microsoft 365, Intune, Defender, and Entra ID audits
- Product context for how the patch feeds and audit outputs are assembled from live sources
👉 Read Senserva's analysis of KEV-listed edge router and firewall flaws →
KEV-listed edge router flaws: what patch teams need to do now?
Explore further
16/09/2026 9:21 am
Edge-management compromise is now an identity problem, not just a vulnerability problem. When attackers hit router or firewall management planes, they are targeting privileged access paths, not only software defects. That means inventory, authentication, and exposure control are inseparable from patching. NIST-CSF and NIST-800-53 both support this view, but the operational point is simpler: if you cannot govern the admin plane, you cannot govern the device.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which shows how quickly governance confidence drops when ownership and visibility fragment.
A question worth separating out:
Q: How should security teams balance patching with access restriction for edge devices?
A: They should do both, but access restriction often delivers the fastest risk reduction. If management interfaces can be removed from the internet, the exploitability window shrinks immediately while patching proceeds. That sequencing is especially important for devices that sit outside normal endpoint tooling and reporting.
👉 Read our full editorial: KEV-listed edge router flaws show why patch priority must change
