TheNote
Cisco Security Advisory Note
GooglePlay AppStore

Cisco Security Advisory

Cisco regularly publishes security advisories to inform users about vulnerabilities in their products and provide guidance on how to address them. These advisories cover a wide range of products and services, including software and hardware. The advisories typically include details about the vulnerability, its impact, and steps for mitigation or remediation. For the latest information, you can visit the Cisco Security Advisories page on their official website.
Cisco Security Advisory sec.cloudapps.cisco.com
RSS sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Desk Phone 9800, 7800 and 8800, and 8875 Series Software IOS XR Software (security hardening release) Nexus 9000 Series Switches Silicon One Secure Email To fully remediate vulnerabilities to be disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Cisco's Transition to a Risk-Based Vulnerability Disclosure Model.Security Impact Rating: Informational
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-f2SiMFxl?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+September+2%2C... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Today

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEtSecurity Impact Rating: HighCVE: CVE-2026-20320
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+BroadWorks+Out-of-Band+Blind+XML+External+Entity+I... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Secure Workload Software Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWPSecurity Impact Rating: CriticalCVE: CVE-2026-20231,CVE-2026-20315,CVE-2026-20317,CVE-2026-20318,CVE-2026-20319
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Workload+Software+Security+Hardening+Re... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco RoomOS Stack Overflow Vulnerability

A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges.This vulnerability is due to insufficient boundary checks for specific data that is provided through the USB driver. An attacker could exploit this vulnerability by connecting a malicious USB device to an affected device. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system and execute arbitrary code with root privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZguSecurity Impact Rating: MediumCVE: CVE-2026-20302
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-bof-vTMANZgu?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+RoomOS+Stack+Overflow+Vulnerability%26vs_k%3D1 sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device.This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5Security Impact Rating: MediumCVE: CVE-2026-20327
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Intelligence+Center+SQL+Injection+Vul... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of another user. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-NgXUFF52Security Impact Rating: MediumCVE: CVE-2026-20232
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-NgXUFF52?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Industrial+Ethernet+1000+Series+Switches+Stored+Cross-Si... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9VhSecurity Impact Rating: CriticalCVE: CVE-2026-20030,CVE-2026-20357,CVE-2026-20358,CVE-2026-20359
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-crosswork-UzDTU9Vh?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Crosswork+Security+Hardening+Release%3A+A... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-ssrf-TghHxDSecurity Impact Rating: MediumCVE: CVE-2026-20314
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-ssrf-TghHxD?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Packaged+Contact+Center+Enterprise+and+Cisco+Uni... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability

A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible. This vulnerability is due to insufficient protection against management plane flooding attacks. An attacker could exploit this vulnerability by sending a high rate of ICMP, SSH, or HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the CPU of the device to increase, resulting in a denial of service (DoS) condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-uxq86LnxSecurity Impact Rating: MediumCVE: CVE-2026-20177
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-uxq86Lnx?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Industrial+Ethernet+1000+Series+Switches+Denial+of+Servi... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 19

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

On August 19, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:BroadWorks Industrial Ethernet 1000 Series Switches Packaged Contact Center Enterprise and Unified Contact Center Enterprise RoomOS Secure Firewall Adaptive Security Appliance Secure Firewall Management Center Secure Firewall Threat Defense Center Secure Workload Unified Intelligence CenterTo fully remediate vulnerabilities to be disclosed on August 19, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-LDquvx5d?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+August+19%2C+2... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 12

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFFSecurity Impact Rating: HighCVE: CVE-2026-20349
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Adaptive+Security+Appliance+an... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 11

ClamAV Vulnerabilities Affecting Cisco Products: August 2026

Multiple vulnerabilities have been discovered in ClamAV, a popular antivirus engine. These vulnerabilities could allow a remote attacker to trigger a denial of service condition. This would interrupt the normal scanning operations of ClamAV. Cisco is planning to release software updates to fix these issues on its affected platforms. Currently, there are no workarounds available to mitigate these vulnerabilities. The Security Impact Rating for Windows-based platforms is High, affecting products like Cisco Secure Endpoint Connector for Windows. This is because ClamAV runs with elevated privileges on these systems. On other platforms like Linux and Mac, the Security Impact Rating is Medium. This lower rating is due to ClamAV running with fewer privileges on these operating systems. Cisco Secure Endpoint Private Cloud is not directly affected, but the connectors distributed from it are vulnerable.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DClamAV+Vulnerabilities+Affecting+Cisco+Products%3A+August+20... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 7

Cisco IOS XE Software SNMP Denial of Service Vulnerability

A critical vulnerability exists within the SNMP subsystem of Cisco IOS XE Software. This flaw allows authenticated, remote attackers to trigger a device reload, leading to a denial of service. The issue stems from incorrect error handling during the processing of SNMP requests. All SNMP versions, including 1, 2c, and 3, are susceptible to this vulnerability. Attackers can exploit this by sending a specially crafted SNMP request to an impacted device. Successful exploitation will cause the device to unexpectedly restart. To exploit this, an attacker needs valid SNMPv1 or v2c community strings or SNMPv3 user credentials. Cisco has already released software updates to fix this vulnerability. Unfortunately, there are no workarounds available, but a mitigation is in place. The security impact rating for this vulnerability is considered High.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-snmp-dos-ZAqNm4MD?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+XE+Software+SNMP+Denial+of+Service+Vulnera... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability

A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker.This vulnerability is due to an incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials could exploit this vulnerability by sending crafted network traffic to an affected device. A successful exploit could allow the attacker to inherit the firewall rules associated with a different user in the system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrevSecurity Impact Rating: MediumCVE: CVE-2026-20028
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrev?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Terminal+Services+Agent+Firewall+Rules+Byp... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability

A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34tSecurity Impact Rating: HighCVE: CVE-2026-20301
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+Software+and+IOS+XE+Software+Extensible+Messagin... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco IOS XE Software Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.The vulnerabilities tracked by CVE-2026-20273 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.Security Impact Rating: CriticalCVE: CVE-2026-20267,CVE-2026-20268,CVE-2026-20269,CVE-2026-20270,CVE-2026-20271,CVE-2026-20272,CVE-2026-20273
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+XE+Software+Security+Hardening+Release%3A... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information.This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging level and then collecting the system logs. A successful exploit could allow the attacker to view sensitive information like user login credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-infodisc-qBXjfmWmSecurity Impact Rating: MediumCVE: CVE-2026-20289
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-infodisc-qBXjfmWm?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+RoomOS+Logging+Subsystem+Information+Disclosu... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Integrated Management Controller Argument Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfUSecurity Impact Rating: HighCVE: CVE-2026-20200,CVE-2026-20288
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Integrated+Management+Controller+Argument+Inj... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device.This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3Security Impact Rating: MediumCVE: CVE-2026-20308
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+XE+Software+Web-Based+Management+Interface+Denia... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Catalyst SD-WAN Software Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.  These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3KSecurity Impact Rating: CriticalCVE: CVE-2026-20303,CVE-2026-20304,CVE-2026-20310,CVE-2026-20312,CVE-2026-20313
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Software+Security+Hardening+Re... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBpSecurity Impact Rating: MediumCVE: CVE-2026-20198
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Integrated+Management+Controller+Cross-Site+Scriptin... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.This vulnerability is due to insufficient access control enforcement for specific template types that are not included in the encryption allowlist. A low-privileged attacker could exploit this vulnerability by viewing logs on the local system or on a remote logging server. A successful exploit could allow the attacker to view sensitive authentication credentials, which could lead to further compromise of network infrastructure and connected services.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-SPuJBDCeSecurity Impact Rating: MediumCVE: CVE-2026-20294
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-SPuJBDCe?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Manager+Information+Disclosure+... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability

A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to improper handling when parsing a specific BEEP SOAP request. An attacker could exploit this vulnerability by sending a specific BEEP SOAP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-bing-MGHrFAkdSecurity Impact Rating: HighCVE: CVE-2026-20263
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-bing-MGHrFAkd?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+XE+Software+Blocks+Extensible+Exchange+Protoco... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Aug 5

Cisco Advance Notification for Publication of August 5, 2026, Security Advisories

On August 5, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Catalyst SD-WAN Integrated Management Controller (IMC) IOS Software IOS XE Software RoomOS Terminal Services AgentTo fully remediate vulnerabilities to be disclosed on August 5, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-L4XfJg8S?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+August+5%2C+20... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 29

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

A vulnerability exists in Cisco Secure Firewall Management Center (FMC) Software's web interface. This issue allows an unauthenticated, remote attacker to access sensitive data. The vulnerability stems from the presence of static user credentials for a low-privileged account. An attacker can exploit this by using these credentials to log into an affected system. A successful intrusion grants the attacker access to sensitive data as that low-privileged user. While internet-facing FMC interfaces increase the risk, the attack surface is smaller otherwise. Cisco rated this vulnerability as High, not Medium, due to its potential for privilege escalation when combined with other vulnerabilities. Software updates have been released by Cisco to fix this issue. There are currently no workarounds available to mitigate this vulnerability. The assigned CVE is CVE-2026-20316.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Management+Center+Software+Sta... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 29

Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to access sensitive files or delete arbitrary files on the affected system.Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2YSecurity Impact Rating: MediumCVE: CVE-2026-20146
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Path+Traversal+Vulnera... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 15

Cisco RoomOS Security Hardening Release: July 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.  These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEqSecurity Impact Rating: HighCVE: CVE-2026-20150,CVE-2026-20153,CVE-2026-20156,CVE-2026-20157,CVE-2026-20158,CVE-2026-20187
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+RoomOS+Security+Hardening+Release%3A+July+202... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 15

Cisco Advance Notification for Publication of July 15, 2026, Security Advisories

On July 15, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Identity Services Engine (ISE) RoomOSTo fully remediate vulnerabilities to be disclosed on July 15, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-ILh3ZrP5?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+July+15%2C+202... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 8

ClamAV Vulnerabilities Affecting Cisco Products: July 2026

Multiple vulnerabilities have been identified in ClamAV that could allow remote attackers to cause denial-of-service conditions. These vulnerabilities specifically interrupt ClamAV scanning operations. Cisco has released software updates to address these security flaws. Unfortunately, there are no workarounds available to mitigate these vulnerabilities.The Security Impact Rating is High for Windows platforms due to the ClamAV scanning process running with elevated privileges. This especially affects Cisco Secure Endpoint Connector for Windows. On Linux and Mac platforms, the Security Impact Rating is Medium. This is because ClamAV runs with lower privileges on these operating systems. Affected Linux and Mac platforms include Secure Endpoint Connector. Cisco Secure Endpoint Private Cloud itself is not vulnerable. However, the Cisco Secure Endpoint Connector software distributed from the device is impacted. Further details and affected CVEs are available in the advisory.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DClamAV+Vulnerabilities+Affecting+Cisco+Products%3A+July+2026... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 1

Cisco Catalyst Center Arbitrary File Read Vulnerability

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read arbitrary files from a restricted container of the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8XSecurity Impact Rating: HighCVE: CVE-2026-20191
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+Center+Arbitrary+File+Read+Vulnerabil... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jul 1

Cisco Advance Notification for Publication of July 1, 2026, Security Advisories

On July 1, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Catalyst Center Secure Endpoint Connectors for Linux, Mac, and WindowsTo fully remediate vulnerabilities to be disclosed on July 1, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-vwL7b0S7?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+July+1%2C+2026... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 24

Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vvSecurity Impact Rating: CriticalCVE: CVE-2026-20181,CVE-2026-20190
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Remote+Code+Execution+and+I... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 17

Cisco Crosswork Network Controller Server-Side Template Injection Vulnerability

A security vulnerability exists in the web-based management interface of Cisco Crosswork Network Controller. This flaw allows an authenticated, remote attacker to execute arbitrary commands. The vulnerability stems from inadequate input validation within the configuration template engine. An attacker can exploit this by submitting a specially crafted request. Successful exploitation grants the attacker the ability to run arbitrary commands on the operating system. However, this is restricted to specific file system areas where the template user possesses write permissions. Crucially, the attacker must have valid template user credentials with write access. Users with only read permissions cannot exploit this vulnerability. Cisco has already released software updates to fix this issue. Unfortunately, no workarounds are available to mitigate this vulnerability.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cnc-inj-QNMeEmxk?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Crosswork+Network+Controller+Server-Side+Template+Inj... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 17

Cisco Webex App Open Redirect Vulnerability

A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage. Cisco has addressed this vulnerability in the Cisco Webex App, and no customer action is needed.This vulnerability existed due to improper input validation of URL parameters in an HTTP request. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to click a crafted URL. A successful exploit could have allowed the attacker to redirect a user to a malicious website.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-redirect-KOyxhffHSecurity Impact Rating: MediumCVE: CVE-2026-20178
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-redirect-KOyxhffH?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Webex+App+Open+Redirect+Vulnerability%26vs... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 17

Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability

A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device.This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AUSecurity Impact Rating: MediumCVE: CVE-2026-20246
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AU?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Umbrella+Virtual+Appliance+Privilege+Escala... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 17

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

A vulnerability has been discovered in the web UI of Cisco Catalyst SD-WAN Manager that could allow an authenticated, remote attacker to create or overwrite any file on the system. This vulnerability exists due to the software's failure to properly validate user-supplied input during a file upload process. An attacker can exploit this vulnerability by sending a crafted HTTP request to the affected API endpoint. To successfully exploit the vulnerability, the attacker must have valid credentials with at least a lower-privileged user account. The attacker could use this vulnerability to create or overwrite any file on the underlying operating system, potentially using it to elevate to root access. Cisco has released software updates to address this vulnerability, but there are no available workarounds. The vulnerability is rated as medium on the security impact scale. The advisory for this vulnerability is available on Cisco's security center website. The CVE number for this vulnerability is CVE-2026-20262, and more information can be found at the provided link. The release of software updates by Cisco aims to mitigate the risk associated with this vulnerability and prevent potential attacks.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Manager+Arbitrary+File+Write+Vulner... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 15

Cisco Catalyst SD-WAN Manager Authenticated Privilege Escalation Vulnerability

A high-severity vulnerability, CVE-2026-20245, has been identified in the CLI of Cisco Catalyst SD-WAN Manager. This flaw allows an authenticated, local attacker with netadmin privileges to execute arbitrary commands as root. The vulnerability stems from insufficient validation of user-supplied input, enabling command injection attacks. An attacker could exploit this by uploading a crafted file to the system. Cisco is aware of limited instances where exploitation led to configuration changes on edge devices. There are currently no workarounds available for this vulnerability. Cisco has not yet released software updates to address the issue. They recommend customers upgrade to a fixed software release documented in their advisory. Before upgrading, it is crucial to collect admin-tech files from control components for forensic analysis. After upgrading, customers should verify system integrity by checking logs for indicators of compromise. If compromise is confirmed, Cisco TAC will provide further remediation steps.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Manager+Authenticated+Privilege... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 4

Cisco Webex Meetings Cross-Site Scripting Vulnerability

A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.As mentioned, Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is necessary to update on-premises software or devices. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzSSecurity Impact Rating: MediumCVE: CVE-2026-20233
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzS?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Webex+Meetings+Cross-Site+Scripting+Vulnerability%2... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 3

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

A critical vulnerability exists in Cisco Unified Communications Manager and its Session Management Edition. This flaw allows an unauthenticated, remote attacker to perform server-side request forgery (SSRF) attacks. The vulnerability stems from improper input validation within specific HTTP requests. Attackers can exploit this by sending a specially crafted HTTP request to an affected device. Successful exploitation enables attackers to write files to the underlying operating system. These written files can subsequently be used to elevate privileges to root access. Cisco specifically rated this vulnerability as Critical due to the potential for root privilege escalation. It is important to note that exploitation requires the WebDialer service to be enabled on the affected device. WebDialer is disabled by default, which somewhat mitigates the immediate risk. Cisco has released software updates to address this security flaw. Currently, no workarounds are available for this vulnerability. The official advisory provides further details on this critical security issue.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Server-Side+Request+F... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 3

Cisco Finesse Remote File Inclusion Vulnerability

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks.This vulnerability is due to insufficient validation of user-supplied input for HTTP requests that are sent to an affected device. An attacker who has knowledge of the address of the affected device could exploit this vulnerability by persuading a user to click a crafted link that contains the affected device address. A successful exploit could allow the attacker to conduct browser-based attacks and execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-rfi-gwpkdc89Security Impact Rating: MediumCVE: CVE-2026-20175
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-rfi-gwpkdc89?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Finesse+Remote+File+Inclusion+Vulnerability%26vs_... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • Jun 3

Cisco Secure Workload Unauthorized API Access Vulnerability

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role.This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuySecurity Impact Rating: CriticalCVE: CVE-2026-20223
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Workload+Unauthorized+API+Access+Vulnerabilit... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 20

Cisco ThousandEyes Virtual Appliance Authenticated Remote Code Execution Vulnerability

A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to execute commands on the underlying operating system as the root user.This vulnerability is due to insufficient validation of user-supplied input. An authenticated attacker could exploit this vulnerability by uploading a crafted certificate to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tevacert-rce-RMJVEym5Security Impact Rating: MediumCVE: CVE-2026-20199
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tevacert-rce-RMJVEym5?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+ThousandEyes+Virtual+Appliance+Authenticated+Rem... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 20

Cisco ThousandEyes Enterprise Agent BrowserBot Command Injection Vulnerability

A vulnerability existed within the BrowserBot component of Cisco ThousandEyes Enterprise Agent, posing a security risk. This flaw could have enabled a remote attacker to execute arbitrary commands. The vulnerability stemmed from inadequate input validation of command arguments provided by the user. An attacker needed valid ThousandEyes SaaS credentials and test management capabilities to exploit this issue. Successful exploitation would have allowed command execution within the BrowserBot container. Cisco has since resolved this vulnerability within the ThousandEyes Enterprise Agent. No customer action is required to address this security issue. There are no available workarounds to mitigate the vulnerability. The security impact was rated as medium. This advisory is associated with CVE-2026-20206. The vulnerability allowed an authenticated attacker to potentially cause harm.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tebbot-cmdinj-wN3yQ5gn?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+ThousandEyes+Enterprise+Agent+BrowserBot+Comman... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 20

Cisco Nexus 3000 and 9000 Series Switches Border Gateway Protocol Denial of Service Vulnerability

A vulnerability affects Cisco Nexus 3000 and 9000 Series Switches operating in standalone NX-OS mode. The enforce-first-as feature of the Border Gateway Protocol (BGP) is implicated in this issue. An unauthenticated, remote attacker can exploit this flaw. The vulnerability stems from incorrect parsing of a transitive BGP attribute. By sending a specially crafted BGP update, an attacker can trigger BGP peer flaps. This disruption leads to a denial of service (DoS) condition. The crafted update is sent through an established BGP peer session. If an affected device receives this update, it will drop the BGP session. Consequently, the device will flap with the peer forwarding the malicious update. Cisco has released software updates to resolve this vulnerability and offers workarounds.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgp-iefab-3hb2pwtx?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Nexus+3000+and+9000+Series+Switches+Border+Gateway+... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 20

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

A new security advisory for Cisco Catalyst SD-WAN Controller and Manager was released in May 2026, addressing a critical vulnerability. This vulnerability allows potential attackers to bypass authentication on the system. The vulnerability lies within the peering authentication mechanism of the SD-WAN controller. An unauthenticated attacker could send crafted requests to exploit this flaw. Successful exploitation grants the attacker administrative privileges as a high-privileged non-root user. This compromised account allows access to NETCONF, enabling manipulation of network configurations. Cisco has issued software updates to resolve this vulnerability, with no available workarounds. Customers are advised to gather diagnostic information before upgrading their systems. The advisory provides guidance on identifying potential compromises using "Show Control Connections". Users should upgrade their software as soon as possible after collecting necessary information. This vulnerability is rated as critical and is identified by CVE-2026-20182.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Controller+Authentication+Bypass+V... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 14

Cisco Catalyst SD-WAN Manager Vulnerabilities

Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow a remote attacker to gain access to sensitive information, elevate privileges, or gain unauthorized access to the application.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7RSecurity Impact Rating: CriticalCVE: CVE-2026-20209,CVE-2026-20210,CVE-2026-20224
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Manager+Vulnerabilities%26vs_k%... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 14

Cisco Prime Infrastructure Information Disclosure Vulnerability

A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary log files from the server.This vulnerability is due to insufficient authorization checks on the download service API. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to download sensitive log files that they would otherwise not have authorization to access.To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-unauth-infodiscl-LFnLgmeySecurity Impact Rating: MediumCVE: CVE-2026-20189
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-unauth-infodiscl-LFnLgmey?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Prime+Infrastructure+Information+Disclosu... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 6

Cisco Identity Services Engine Authentication Bypass Vulnerabilities

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow a remote attacker to bypass authorization mechanisms or examine error messages to gain access to sensitive information on an affected device.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-bypass-uxjRXGpbSecurity Impact Rating: MediumCVE: CVE-2026-20193,CVE-2026-20195
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-bypass-uxjRXGpb?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Authentication+Byp... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 6

Cisco Slido Insecure Direct Object Reference Vulnerability

A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect quiz and poll results. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed.This vulnerability existed because of the presence of an insecure direct object reference. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by sending a crafted request to the vulnerable API endpoint. A successful exploit could have allowed the attacker to view the social profiles of other users or affect quiz and poll results.As mentioned, Cisco has addressed this vulnerability in the Slido service, and no customer action is necessary to update on-premises software or devices. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-slido-idor-CpsFmKxNSecurity Impact Rating: MediumCVE: CVE-2026-20219
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-slido-idor-CpsFmKxN?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Slido+Insecure+Direct+Object+Reference+Vulnerabili... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 6

Cisco IoT Field Network Director Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco IoT Field Network Director Software could allow an authenticated, remote attacker to access files, execute commands, and cause denial of service (DoS) conditions on managed routers.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4uSecurity Impact Rating: HighCVE: CVE-2026-20167,CVE-2026-20168,CVE-2026-20169
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IoT+Field+Network+Director+Vulnerabilities%26vs_k... sec.cloudapps.cisco.com
RSS Hunter RSS Hunter • May 6