Three critical remote code execution flaws landed in enterprise products within a week of each other, and all three are the same programming mistake: software that takes a blob of data from a stranger and rebuilds it into a live object without first asking whether it should. Two are in Cisco management consoles, one is in Dell storage software, and one of them carries a flat 10 out of 10.
The mistake has a name, insecure deserialization, and it has sat on vulnerability top-ten lists for a decade. Serialization is how a program flattens an object into bytes so it can be sent or stored; deserialization is the reverse. If a program will rebuild whatever bytes arrive, somebody can send it bytes that rebuild into something which runs commands.
Dell's object store takes a flat 10
Dell ObjectScale, the object storage platform formerly sold as Elastic Cloud Storage, carries CVE-2026-70416. Dell's description is that versions prior to 4.4.0.0 contain a deserialization of untrusted data vulnerability, and that an unauthenticated attacker with remote access could potentially exploit it, leading to remote execution. Dell scores it 10.0, the maximum the scale allows, in advisory DSA-2026-393, published on 10 September. ECS versions 3.x through 3.8.1.7 are listed alongside it. The fix is 4.4.0.0 or later. Dell credits WinD39, Huynh Dinh Vu, and does not say the flaw has been exploited.
Cisco ISE: small login, large reward
CVE-2026-20307 sits in the web management interface of Cisco Identity Services Engine, the system many organizations use to decide who and what is allowed onto the network. Cisco scores it 9.9. An attacker needs at least low-privileged administrative credentials, and with them can run arbitrary commands on the underlying operating system through a user-supplied Java byte stream. The same advisory covers CVE-2026-20176 and CVE-2026-20211, both 9.1, which need high-privileged credentials. Cisco says there are no workarounds and that its PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described. The reports are credited to Jasper Westerman, Yanick de Pater and Harm Blankers of REQON, Jonathan Lein of TrendAI Research, and Li Jiantao and Tevel Sho of STAR Labs SG.
The firewall console needs no login at all
CVE-2026-20242, scored 9.8, is the one with no barrier in front of it. It lives in the External Database Access feature of Cisco Secure Firewall Management Center, the console administrators use to run their firewalls, and Cisco says an unauthenticated remote attacker can execute arbitrary commands as root by way of an insecurely deserialized Java byte stream sent from a host configured in the external database access list. Cisco states there are no workarounds that address the vulnerability, credits Andy Niu of TrendAI Research, and reports no known malicious use. Its advisory is separate from the Secure Firewall hardening batch IntelFusions covered this week, and it deserves more urgency than an FMC bug normally would, because FMC servers were being rooted through a different flaw earlier this month by a Russian state crew and a ransomware operation alike.
FMC first, then ISE, then ObjectScale
Take the unauthenticated one first: patch Secure Firewall Management Center, using Cisco's Software Checker, since the advisory points there rather than naming fixed builds. For ISE the fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 3 or later, depending on the identifier. ObjectScale goes to 4.4.0.0. None of the three has a workaround, so there is nothing to do but upgrade.
Peru's CNSD gathered the Cisco and Dell items into an integrated security alert on 17 September. What links them is older than any of the products: a management plane that will still accept a serialized object from somewhere it should not trust.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.