The second entrance had no lock

Two vendor advisories, written months apart by different companies about different products, carry the same four-digit number in the weakness field. CWE-288 [1][2].

MITRE’s description of it fits in a sentence. The product requires authentication, and the product also has another path that does not [4].

On September 9, 2026, CISA added both to the Known Exploited Vulnerabilities catalog, with the same three-day remediation date [3]. One is the console that manages your firewalls. The other is the appliance that terminates your remote access.

What happened

CVE-2026-20079 affects Cisco Secure Firewall Management Center. An unauthenticated remote attacker can bypass authentication through the web interface and execute scripts to obtain root on the underlying operating system [1][5]. Cisco rates it 10.0, the maximum, and the root cause is given in one sentence: an improper system process created at boot time [1]. Every version of Secure FMC Software is affected, along with Security Cloud Control Firewall Management. Firewall Device Manager, Secure Firewall ASA and Threat Defense are not [1].

The advisory was first published on March 4, 2026. Cisco updated it on September 9 to record that “in August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability” [1].

CVE-2026-19490 affects NetScaler ADC and NetScaler Gateway. Cloud Software Group published it on August 19, 2026, describes it as an authentication bypass using an alternate path, and scores it 9.3 under CVSS 4.0 [2]. It is gated behind configuration. The appliance has to be a Gateway, meaning SSL VPN, ICA Proxy, CVPN or RDP Proxy, or an AAA virtual server. On 14.1-43.56 and later, and on 13.1-61.28 and later, it also needs a SAML action configured [2].

Neither vendor offers a workaround [1][2].

CISA gave both until September 12, 2026 [3]. They arrived alongside an exploited Fortinet flaw carrying the same deadline, and a Chromium out of bounds write with a longer one [3].

The long stretch in the middle is the part worth taking to whoever owns your change calendar. A maximum-severity flaw with no workaround sat patchable for roughly five months before anyone confirmed it was being used.

Why this matters

These are the boxes that enforce everything else. Secure FMC is where firewall policy is written and pushed. A NetScaler Gateway is where remote access sessions terminate. Compromising the management plane is cheaper than attacking what it manages, because the management plane is already trusted by the things downstream.

No workaround means the version is the only control. Most weeks you can buy time with a configuration change, a firewall rule, or turning a feature off. Neither vendor offers that here [1][2]. The upgrade is the mitigation, which changes the conversation with whoever owns the maintenance window.

One of them was fixable for six months. The Cisco advisory, with its 10.0 and its explicit note that nothing but patching helps, has been public since March 4, 2026 [1]. Exploitation came later. That gap is the ordinary shape of appliance patching, and it is why edge and management devices keep appearing in KEV.

Technical breakdown

CWE-288 is worth understanding as a class, because these two are not the last examples you will see.

The weakness is not a broken check. The check usually works exactly as designed on the route it guards. The problem is that a second route exists to the same functionality, and nobody put a check on it, usually because nobody remembered it was a route at all. MITRE’s mitigation guidance is correspondingly simple: funnel every access attempt through one point that performs the check, instead of trusting that all the entrances were enumerated [4].

That is a design property rather than a coding error, which explains the shape of both cases. Cisco’s alternate path traces to a system process created at boot, not to the authentication code [1]. Citrix’s is gated behind having a SAML action configured, which suggests the alternate path is opened by a particular authentication configuration rather than being present by default [2]. Citrix does not say more than that, and I am not going to infer the mechanism from a precondition list.

The scoring signals diverge in a way that is worth reading rather than averaging. On September 9, EPSS put CVE-2026-20079 at 35.9 percent, the 98th percentile, and CVE-2026-19490 at 3.4 percent, the 88th [6]. Both are high. The first is unusually high, and it belongs to a CVE that has been public since March, which is the situation EPSS is actually good at. Contrast that with a genuine zero-day, where the model has nothing to work from and reports nothing useful.

One negative result worth recording: I found no public proof of concept on GitHub for CVE-2026-20079. That does not mean none exists, because GitHub is one place and exploitation is confirmed regardless. It does mean that whoever is using this brought their own tooling.

The three breaks are the precondition check, the upgrade and the change monitoring. Only the upgrade closes the flaw. The first tells you how fast you have to move, and the third is how you find out whether you moved fast enough.

What defenders should do Monday morning

Immediate, within 24 hours. Inventory Secure FMC and Security Cloud Control Firewall Management instances and apply Cisco’s hot fix for your train, from 7.0 through 10.0 [1]. Every version is affected, so there is no version to confirm yourself safe on. For NetScaler, check the precondition first using the configuration strings Citrix published, then upgrade to 14.1-73.32, 13.1-63.21, or the matching FIPS builds [2]. Both deadlines are September 12, 2026 [3].

Near term, this week. Confirm whether either management interface is reachable from anywhere untrusted, and fix that independently of the patch. A firewall management console does not need to answer the internet, and the fact that patching is the only vendor-supplied control is a good argument for adding one of your own. Pull configuration and audit events off both appliance types into somewhere an analyst reads, and check the last six months of administrative changes on FMC against your change records, because the Cisco flaw has been exploitable since March.

Structural, this quarter. Go looking for CWE-288 in your own estate. The question to ask of any product that authenticates users is whether it has more than one way to reach the same function: a management API alongside a web UI, a legacy endpoint kept for compatibility, a health or diagnostic route, an inter-node channel. Then ask who checks credentials on each of them, and whether that is one shared component or several. Where the answer is several, you have the same design property both vendors just shipped.

Checklist

• Secure FMC and Security Cloud Control instances inventoried, with no version assumed safe
• Cisco hot fix applied across the 7.0 to 10.0 trains
• NetScaler precondition checked with the published configuration strings
• NetScaler upgraded to 14.1-73.32, 13.1-63.21 or the matching FIPS build
• Both remediations completed against the September 12, 2026 date
• Management interfaces confirmed unreachable from untrusted networks
• Appliance configuration and audit events forwarded off the device
• Six months of FMC administrative changes reconciled against change records
• Alerting in place for policy or gateway authentication changes without a ticket
• Estate reviewed for other products with more than one route to the same function

Two entrances, one guard

The tempting reading is that two vendors got unlucky in the same week. The more useful one is that both shipped a product with more than one way in, and put the check on the way in they were thinking about.

That is not carelessness so much as arithmetic. Every product accumulates routes: the web interface people use, the API the automation uses, the channel the cluster members use, the process that starts at boot and listens for something. Each is added by someone solving a real problem, and each is a place where the question “does this caller need to prove who they are” has to be asked again by a different person, sometimes years apart. MITRE’s advice to funnel everything through one enforcement point is correct and unpopular, because it means the convenient shortcut is architecturally unavailable.

For defenders the practical version is smaller. When you evaluate anything that guards something else, ask how many ways in it has, and ask whether one component or several answers the authentication question. A vendor that cannot answer that quickly has not enumerated its own entrances, which is the precondition for this whole class. That question costs nothing in a procurement call and it is the only part of this you can act on before the next advisory lands.