InfraTrust: Network Management Systems Under Attack
InfraTrust's September report finds attackers targeting network management and control infrastructure at or before patch availability. Here's what to prioritize.
Marisol "Fuse" DelgadoA new InfraTrust report covered by BleepingComputer documents a pattern defenders have been watching take shape across this year’s KEV catalog: attackers are going after the management plane of enterprise infrastructure directly, often exploiting critical vulnerabilities before or within days of vendor disclosure.
The evidence is in the KEV entries from the past two weeks.
What’s getting hit
Network management systems sit at the top of the infrastructure stack. They control configuration, policy enforcement, authentication, and monitoring for the devices underneath them. Compromise them, and everything below is reachable without further exploitation.
The last two weeks illustrate the problem concretely. Check Point patched two separate management server remote code execution flaws in the space of six days: CVE-2026-93616, added to CISA’s KEV catalog on September 23, and CVE-2026-91843, disclosed September 18. Both were exploited before most organizations had a patch cycle to respond. Arista separately confirmed active exploitation of a VeloCloud Orchestrator zero-day in on-premises deployments, urging emergency patching. Cisco’s Firepower Management Center drew a CVSS 10.0 rating and confirmed exploitation before a patch was broadly applied.
The pattern InfraTrust identifies is not about any single vendor. It is about the product category. Management consoles and orchestration layers are the target because they are the highest-privilege access point in the environment.
Why this matters for patch prioritization
The traditional priority model says to patch public-facing services first, then internal systems, then management infrastructure last because it is “internal only.” That model breaks down when management infrastructure has its own externally reachable surface (most modern NMS platforms do, for cloud APIs, remote access, and SaaS integrations) and when attackers are specifically hunting for it.
If your management plane is reachable, even over VPN or restricted network, it belongs in your first patch tier, not your last. InfraTrust’s report reinforces what the KEV catalog has been signaling for months: management systems with unpatched critical flaws are being found and exploited.
What to do
Start with inventory. Identify every management console, orchestration platform, and policy controller in your environment: firewalls with admin UIs, network management systems, SIEM consoles, endpoint management platforms, anything that issues configuration to other infrastructure.
For any of these running software with a CVSS 9.0+ or KEV-listed vulnerability, treat it as a first-tier patch. Not second or third. Patch in the next maintenance window, not the next quarterly cycle.
Access controls
If the management plane is reachable from the general corporate network or from the internet, that is an architecture problem worth fixing independently of any specific CVE. Dedicated admin VLANs with no lateral reach to user networks reduce the blast radius when a management system gets compromised.
Detection
Management systems are high-value lateral movement targets. If you are not logging admin actions, configuration changes, and authentication events from your NMS platforms into your SIEM, fix that now. The attack value of compromising management infrastructure is that it is silent unless you are watching for it.
Context from InfraTrust’s prior research
InfraTrust’s earlier firmware and edge device prioritization report from July documented similar urgency at the firmware layer of network devices. This month’s report extends that analysis to the management systems sitting above the hardware. Both point to the same operational gap: defenders patch applications and operating systems on a routine cycle but treat infrastructure control planes as maintenance burdens rather than attack surfaces.
The KEV catalog is the clearest signal available on what attackers actually exploit. Right now, it is telling you to look at your management plane.
Sources
- BleepingComputer. InfraTrust report warns network management systems under attack, September 23, 2026.
- CISA. Known Exploited Vulnerabilities Catalog.
- Related: Check Point Patches Management Server Zero-Day CVE-2026-93616, Check Point Management RCE CVE-2026-91843.
Found this useful? Share it.
