What landed in CVE-land this week

CISA added ten CVEs to the Known Exploited Vulnerabilities catalog in the run-up to 28 September 2026, and vendor advisories on the 28th were dominated by a Cisco Secure Firewall and Identity Services Engine bundle. This digest covers the two that application-security and network-defence teams must act on by Monday: the WordPress Core remote file inclusion added to KEV on 25 September, and the Cisco Secure Firewall Management Center authentication bypass published on 28 September.

Under CISA's current KEV remediation directive, BOD 26-04 (Prioritizing Security Updates Based on Risk, effective 10 June 2026), both carry mandatory remediation timelines for federal civilian agencies and a clear signal that private-sector organisations should follow on their own SLAs.

CVE-2026-87902: WordPress Core remote file inclusion

The KEV entry is terse: WordPress Core "contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution." Read it precisely.

Three things stand out. First, this is unauthenticated: no login step, no privilege prerequisite, no plugin interaction. Second, the bug is in Core, not a third-party plugin or theme. Every unpatched WordPress site is a candidate, regardless of the stack built on top of it. Third, the wording is "remote file inclusion" but the mechanism is a local file inclusion primitive with an attacker-chosen path, promoted to RCE because the included file executes as PHP. Any readable .php file on disk becomes a candidate gadget: bundled examples, uploaded content that landed under a .php name because an unrelated plugin permitted it, or an attacker's own file dropped through a benign upload path elsewhere on the host.

The exploit chain is not "one HTTP request and root." It is:

  1. Reach page-template resolution as an unauthenticated visitor.
  2. Influence the template path to escape the active theme directories and land on a chosen readable .php file.
  3. Execute a payload from that file: shell dispatch, config leak, or a persistent web shell.

Detection is straightforward. Template resolution errors, require/include warnings referring to paths outside wp-content/themes/, and 200-response POSTs to unusual page/template parameters all warrant investigation. An access-log grep for path traversal fragments against front-end endpoints is a fast first pass:

# Look for template-resolution requests that carry traversal or absolute paths.
zgrep -E 'template=|page_template=|pagename=' /var/log/nginx/access.log* \
  | grep -E '(\.\./|/etc/|/var/|/tmp/|/usr/|\.php[^A-Za-z0-9])' \
  | awk '{print $1, $4, $7, $9}' \
  | sort -u

For every WordPress property you own, answer:

The fix is upgrading to the patched WordPress Core release. No configuration-only mitigation closes the primitive because the vulnerable code path is in Core's template resolver. A WAF rule blocking obvious traversal in template parameters is worth deploying as belt-and-braces, but treat it as detection, not remediation. Follow up with a review of upload endpoints so that even if the primitive resurfaces, no attacker-controlled .php file sits on disk to point it at.

CVE-2026-20079: Cisco Secure Firewall Management Center authentication bypass

Cisco published CVE-2026-20079 on 28 September as a critical authentication bypass in the Secure Firewall Management Center (FMC) web interface. The advisory describes a flaw that allows "an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system." The root cause is "an improper system process that is created at boot time," triggered by crafted HTTP requests to the web interface.

FMC is the control plane for Cisco Secure Firewall deployments. An attacker with root on FMC can push policy, alter rulebases, disable logging, and pivot to every data-plane firewall it manages. Treat this as a control-plane compromise, not a single-host incident.

The same 28 September wave includes CVE-2026-20242 (Java deserialization RCE against FMC's External Database Access feature) and CVE-2026-20340 (a bundle of FMC issues covering root access, sensitive file download, SQL injection, and DoS). The Cisco hardening release CVE-2026-20329 notes that two internally discovered issues in this batch are actively exploited. That does not reduce the priority of CVE-2026-20079; it raises the priority of the entire FMC and Identity Services Engine fleet (CVE-2026-20176, CVE-2026-20282, CVE-2026-76423), alongside CVE-2026-76461 in Secure Email Gateway. Plan the maintenance windows now.

The first exposure question is who can reach the FMC web interface. It should never be internet-facing. Confirm from an admin workstation:

# From outside the management network, confirm the FMC web UI is not reachable.
for host in fmc.example.com; do
  curl -sS -o /dev/null -w "%{http_code} %{url_effective}\n" \
    --max-time 5 "https://${host}/"
done

Any non-timeout, non-error response from an untrusted vantage point is a finding, independent of patch state. Combine that with an urgent upgrade to the fixed FMC train and a review of authentication logs for anomalous script execution or new local accounts created on or after 28 September.

What to do this week

Prioritise by blast radius, not CVSS. Both sit at the top of the queue: a WordPress Core RFI that any drive-by scanner will weaponise, and an FMC pre-auth root that hands over the firewall control plane. Everything else in this week's KEV additions (SharePoint, Adobe Commerce, WSO2, F5 BIG-IP APM, Arista VeloCloud Orchestrator, two Check Point issues, MikroTik RouterOS, Zyxel GS1900) belongs in the same sprint, in that order or in an order that reflects your own attack surface.

Verifiable security.