Cisco Security Advisory - TheNote.app

Cisco Security Advisory
Follow

Cisco regularly publishes security advisories to inform users about vulnerabilities in their products and provide guidance on how to address them. These advisories cover a wide range of products and services, including software and hardware. The advisories typically include details about the vulnerability, its impact, and steps for mitigation or remediation. For the latest information, you can visit the Cisco Security Advisories page on their official website.

Cisco Security Advisory sec.cloudapps.cisco.com

RSS sec.cloudapps.cisco.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate.This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GOSecurity Impact Rating: MediumCVE: CVE-2026-20241

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Authorization+Bypass+Vulner... sec.cloudapps.cisco.com

RSS Hunter • Nov 4

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5zSecurity Impact Rating: MediumCVE: CVE-2026-76419

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Cross-Site+Scripting+... sec.cloudapps.cisco.com

RSS Hunter • Nov 4

Cisco UCS Central Software Remote Code Execution Vulnerability

Cisco UCS Central Software has a critical vulnerability in its web-based management interface. This flaw allows authenticated, remote attackers to execute arbitrary code or access sensitive information. The vulnerability stems from inadequate validation of user input within HTTP requests. Attackers can exploit this by sending a specially crafted HTTP request to a vulnerable endpoint. Successful exploitation grants the ability to run arbitrary commands and write files to the filesystem. Additionally, sensitive information can be retrieved by the attacker. Valid user credentials on the affected device are required for exploitation. Cisco has issued software updates to fix this vulnerability. Currently, no workarounds are available to mitigate this issue. This vulnerability has a High Security Impact Rating. It is identified by the CVE number CVE-2026-76506.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+UCS+Central+Software+Remote+Code+Execution+Vulnerabi... sec.cloudapps.cisco.com

RSS Hunter • Nov 4

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75Security Impact Rating: HighCVE: CVE-2026-76418

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Adaptive+Security+Appliance... sec.cloudapps.cisco.com

RSS Hunter • Oct 28

Cisco Advance Notification for Publication of November 4, 2026, Security Advisories

On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Identity Services Engine (ISE) UCS Central Software Unified Communications ManagerTo remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability information for the remainder of calendar year 2026. The next planned publication of advisories for security-hardened releases will be January 20, 2027.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-I8z3n6lK?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+November+4%2C+... sec.cloudapps.cisco.com

RSS Hunter • Oct 28

Vulnerabilities in node.js Affecting Cisco Products: October 2026

Node.js has released security updates for its 22.x, 24.x, and 26.x supported release lines on October 21, 2026. These updates address multiple vulnerabilities impacting key functionalities. The affected areas include the Brotli decoder, DNS resolution, and TLS certificate validation. Some vulnerabilities carry a high Security Impact Rating. Specifically, CVE-2026-111497 allows for potential remote code execution due to an out-of-bounds write in the Brotli decoder. CVE-2026-105482 relates to DNS resolution truncation when NUL characters are embedded. Two vulnerabilities, CVE-2026-105483 and CVE-2026-106069, permit TLS hostname validation bypasses using fullwidth IP digits or noncanonical IP addresses respectively. These vulnerabilities pose risks of remote code execution and traffic interception. Cisco has confirmed that products not listed in their advisory are not affected. The advisory will be updated as more information becomes available.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+node.js+Affecting+Cisco+Products... sec.cloudapps.cisco.com

RSS Hunter • Oct 27

Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered.A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates.Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.This advisory will be updated as additional information becomes available.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1rSecurity Impact Rating: Informational

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Informational+for+Emergency+Distrust+of+eMudhra+... sec.cloudapps.cisco.com

RSS Hunter • Oct 23

Vulnerabilities in PHP Affecting Cisco Products: October 2026

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global stateFor information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384DaqSecurity Impact Rating: Critical

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+PHP+Affecting+Cisco+Products%3A+Oc... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Expressway Series Information Disclosure Vulnerability

A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTSThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Expressway Series see Cisco Expressway Series Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-76435

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Expressway+Series+Information+Disclosure+... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Expressway Series Remote Code Execution Vulnerability

Cisco Expressway Series devices are vulnerable to an unauthenticated, remote attacker gaining root access. This critical vulnerability allows arbitrary operating system command execution. The flaw stems from persistent cookies and insufficient client certificate validation when TLS Verify Mode is enabled for clustering. An attacker can exploit this by possessing these cookies and invoking specific RPC commands on the database service. Successful exploitation grants root privileges on the affected device's operating system. Cisco Expressway Core and Edge devices are both impacted. Cisco has released software updates to address this vulnerability. There are no available workarounds to mitigate the risk. This advisory is part of a larger group of security advisories. Refer to Cisco's security advisories and hardening releases for further details. The vulnerability is identified as CVE-2026-76466.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Expressway+Series+Remote+Code+Execution+Vulne... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed. An attacker could exploit this vulnerability by sending crafted SMTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKktThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20011

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+SMTP+MIME+Denial+... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-RmecfepzThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-76445

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+Denial+of+Servi... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Unified CM, see Cisco Unified Communications Products Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-76487

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Improper+Access+Co... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability

A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.Cisco has released software updates that address this vulnerability. There is a workaround that addresses this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20218

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+Visual+Basic+for+... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability

A critical vulnerability has been identified in the interprocess communication (IPC) channel of the Secure Firewall Posture module within Cisco Secure Client. This flaw permits an authenticated, local attacker to escalate privileges on affected devices. The vulnerability stems from inadequate validation of user-supplied input. Attackers can exploit this by sending specially crafted IPC messages to a local socket. Successful exploitation allows for limited file write operations using SYSTEM or root privileges. While the vulnerability affects Windows, macOS, and Linux, it poses a greater risk on macOS and Linux. On these operating systems, attackers can achieve full root privileges. Due to this potential for full root compromise, Cisco has assigned a High Security Impact Rating despite the initial score suggesting Medium. Cisco has released software updates to address this vulnerability. Currently, no workarounds are available. This advisory details a serious security concern that requires immediate attention from users. The vulnerability is tracked under CVE-2026-76462.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Client+Secure+Firewall+Posture+Mod... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Expressway Series Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release.Cisco has released a software update that addresses these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcsThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.Security Impact Rating: HighCVE: CVE-2026-76490,CVE-2026-76491,CVE-2026-76492,CVE-2026-76493,CVE-2026-76494,CVE-2026-76495,CVE-2026-76496,CVE-2026-76497

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Expressway+Series+Security+Hardening+Release%3... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic.The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXNSecurity Impact Rating: HighCVE: CVE-2026-76505

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+IOS+XR+Software+for+ASR+9000+Series+Routers+IPv4+Unicas... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the Details section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTvThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20221

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+Generic+Routing+Encapsul... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco-owned Open Source Snort 3 engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQeThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. Security Impact Rating: CriticalCVE: CVE-2026-20043,CVE-2026-20236,CVE-2026-20291,CVE-2026-20356

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+Security+Hardening... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Unified Communications Products Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.Security Impact Rating: CriticalCVE: CVE-2026-76473,CVE-2026-76474,CVE-2026-76475,CVE-2026-76476,CVE-2026-76477,CVE-2026-76478,CVE-2026-76479,CVE-2026-76481

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Products+Security+Hard... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability

A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfeThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: HighCVE: CVE-2026-76524

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DOpen+Source+Snort+3+Control+Channel+Socket+Arbitrary... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities

Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAKThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20019,CVE-2026-20179,CVE-2026-20197,CVE-2026-76489

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DMultiple+Cisco+Products+Snort+3+Denial+of+Service+V... sec.cloudapps.cisco.com

RSS Hunter • Oct 21

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A critical vulnerability exists in Cisco Secure Email Gateway's Advanced Malware Protection feature. This flaw allows an unauthenticated, remote attacker to write arbitrary files to the operating system. The issue stems from improper handling of email attachments when the file reputation service is active. An attacker can exploit this by sending a specially crafted attachment via email. Successful exploitation grants the attacker root privileges for file writing and command execution. Cisco has released software updates to fix this vulnerability. Currently, there are no workarounds available to mitigate the risk. This advisory is documented under CVE-2026-76519. Users are encouraged to install the provided software updates promptly. Further details on security fixes can be found in the Cisco Secure Email Gateway security hardening release notes.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Email+Gateway+Arbitrary+File+Write+Vulnerabili... sec.cloudapps.cisco.com

RSS Hunter • Oct 14

Cisco Advance Notification for Publication of October 21, 2026, Security Advisories

On October 21, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Expressway Series (security hardening release) IOS XR Software for ASR 9000 Series Routers Secure Client Snort (security hardening release) Unified Communications products (security hardening release)To remediate vulnerabilities to be disclosed on October 21, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-QGwHnJ6k?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+October+21%2C+... sec.cloudapps.cisco.com

RSS Hunter • Oct 14

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A critical vulnerability exists in Cisco NX-OS Software's NX-API feature, identified as CVE-2026-76471. This flaw allows unauthenticated, remote attackers to execute arbitrary code with root privileges or cause a denial of service. The vulnerability stems from inadequate input validation of data sent to the NX-API. Attackers can exploit this by sending specially crafted HTTP requests to the NX-API. Successful exploitation can lead to arbitrary code execution at the root level. It can also trigger process crashes, potentially resulting in device reloads and a denial of service. Cisco has issued software updates to fix this vulnerability. Currently, there are no available workarounds to mitigate this issue. The security impact of this vulnerability is rated as critical. Further details are available in the Cisco Security Advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+NX-OS+Software+NX-API+Remote+Code+Execution+Vulnerab... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfhSecurity Impact Rating: CriticalCVE: CVE-2026-76498,CVE-2026-76499,CVE-2026-76500

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Application+Policy+Infrastructure+Controller+Se... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service (DoS) condition, or elevate privileges.For more information about these vulnerabilities, see the Details section of this advisory.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhEFor further documentation of improvements and fixes in Cisco License On-Prem, see Cisco License (Smart Software Manager) On-Prem Security Hardening Release.Security Impact Rating: CriticalCVE: CVE-2026-20328,CVE-2026-76437,CVE-2026-76452,CVE-2026-76454

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+License+%28Smart+Software+Manager%29+On-Prem+Vulne... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A critical vulnerability has been identified in the web-based management API of Cisco APIC. This flaw allows authenticated remote attackers to execute arbitrary commands. Exploitation requires the attacker to possess valid administrative credentials. The vulnerability stems from inadequate validation of user-supplied command arguments within the API. By sending specially crafted input, an attacker can gain root-level privileges on the affected device's operating system. Cisco has already released software updates to fix this security issue. Unfortunately, there are no available workarounds to mitigate this vulnerability. The advisory provides detailed information and is accessible online. This particular advisory is one of several released by Cisco concerning security updates. The overall security impact of this vulnerability is rated as medium.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cmdinj-L6VR4E7?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Application+Policy+Infrastructure+Controller+API+C... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco NX-OS Software Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtRSecurity Impact Rating: CriticalCVE: CVE-2026-76453,CVE-2026-76455,CVE-2026-76456,CVE-2026-76457,CVE-2026-76458,CVE-2026-76459

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+NX-OS+Software+Security+Hardening+Release%3A+... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability has been identified in Cisco NX-OS Software's Python interpreter. This flaw allows a local attacker who is already authenticated and has low privileges to break out of the Python sandbox. The vulnerability stems from inadequate validation of user-provided input within the interpreter. By manipulating certain Python functions, an attacker can achieve this escape. A successful exploit would grant the attacker the ability to run unauthorized commands on the device's operating system. Crucially, the attacker must possess Python execution privileges to exploit this vulnerability. Cisco has released software updates that resolve this security issue. There are currently no alternative workarounds available to mitigate this vulnerability. The security impact of this vulnerability has been rated as Medium. This specific vulnerability is tracked under CVE-2026-20032.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+NX-OS+Software+Python+Sandbox+Escape+Vulnerability%... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

A critical vulnerability exists in the MPLS OAM feature of Cisco NX-OS Software on Nexus 3000 and 9000 Series Switches. This flaw allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or induce a denial of service. The vulnerability stems from improper validation of MPLS echo-request packets. An attacker can exploit this by sending a specially crafted echo-request to an affected device's IP address. Successful exploitation grants root access and may lead to process crashes. This can further result in device reloads, causing a denial of service. Cisco has released software updates to mitigate this vulnerability. No workarounds are available to address this specific issue. This advisory, available on Cisco's security center, is part of a larger group of advisories. Further details on fixes are documented in the Cisco NX-OS Software Security Hardening Release. The vulnerability is identified as CVE-2026-76465.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Nexus+3000+and+9000+Series+Switches+MPLS+OAM+Remote+C... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhfSecurity Impact Rating: CriticalCVE: CVE-2026-76480,CVE-2026-76482,CVE-2026-76483,CVE-2026-76484

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+License+%28Smart+Software+Manager%29+On-Prem+Se... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Meraki Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GHSecurity Impact Rating: CriticalCVE: CVE-2026-76463,CVE-2026-76464,CVE-2026-76467,CVE-2026-76468,CVE-2026-76469,CVE-2026-76470,CVE-2026-76472

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Meraki+Security+Hardening+Release%3A+Octo... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability

A vulnerability exists in Cisco Application Policy Infrastructure Controller (APIC) affecting its export policies functionality. An authenticated, remote attacker can exploit this flaw to gain access to sensitive files. The attacker needs valid administrative credentials to initiate the exploit. The root cause of this vulnerability stems from insufficient access control to file system resources. By submitting crafted values within specific UI fields, an attacker can trigger the vulnerability. Successful exploitation grants access to sensitive files on the underlying file system. Critically, this includes key materials that could facilitate privilege escalation to root. The attacker could achieve root privileges on both the affected APIC and its managed switches. Cisco has already deployed software updates specifically designed to remediate this vulnerability. Unfortunately, there are no available workarounds to mitigate this issue. This vulnerability is identified as CVE-2026-76488. Cisco's security impact rating for this vulnerability is Medium. Further details are available in the link provided in the advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Application+Policy+Infrastructure+Controller+U... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Finesse Server-Side Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugSSecurity Impact Rating: HighCVE: CVE-2026-20362

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Finesse+Server-Side+Request+Forgery+Vulnerabilit... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco NX-OS Software Control Plane Denial of Service Vulnerability

A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 7, 2026, Security Advisories. For further documentation of improvements and fixes in Cisco NX-OS Software, see Cisco NX-OS Software Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20173

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+NX-OS+Software+Control+Plane+Denial+of+Service+V... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

Cisco NX-OS Software's Next Generation OAM (NGOAM) feature contains multiple critical vulnerabilities. These vulnerabilities allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service. The root cause is improper input validation of IP traffic when NGOAM is enabled on an affected device. An attacker can exploit these by sending specially crafted packets to an IP interface. Successful exploitation can lead to arbitrary code execution with root privileges. It can also cause process crashes, resulting in device reloads and a denial of service. Specific feature requirements for exploitation vary per vulnerability. Cisco has released software updates to address these issues. Currently, no workarounds are available. This advisory is part of a larger group of security advisories. The security impact rating for these vulnerabilities is critical. Three CVEs are associated with these vulnerabilities: CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Nexus+3000+and+9000+Series+Switches+NGOAM+Remote+Cod... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability

A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLfThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 7, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco NX-OS Software, see Cisco NX-OS Software Security Hardening Release: October 2026.Security Impact Rating: MediumCVE: CVE-2026-20038

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Nexus+9000+Series+Fabric+Switches+in+ACI+Mode+Endp... sec.cloudapps.cisco.com

RSS Hunter • Oct 7

Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products:Application Policy Infrastructure Controller (security hardening release) Finesse License On-Prem, formerly Cisco Smart Software Manager On-Prem (security hardening release) Meraki (security hardening release) NX-OS Software for MDS 9000, Nexus 3000, 7000, and 9000 Series Switches, Nexus 9000 in ACI mode, and UCS Fabric Interconnects (security hardening release)To remediate vulnerabilities to be disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Security Impact Rating: Informational

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-fBn58ELx?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Advance+Notification+for+Publication+of+October+7%2C+2... sec.cloudapps.cisco.com

RSS Hunter • Sep 30

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuUSecurity Impact Rating: CriticalCVE: CVE-2026-76504

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Catalyst+SD-WAN+Manager+API+Authentication+Bypa... sec.cloudapps.cisco.com

RSS Hunter • Sep 30

Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability

A critical vulnerability has been identified in Cisco Secure Firewall Management Center (FMC) Software, specifically within the sftunnel inter-device communication protocol. This flaw could permit an authenticated, remote attacker to execute arbitrary commands with root privileges on affected devices. The vulnerability stems from a registered sftunnel peer possessing incorrect permissions to write an arbitrary file to any location. Attackers could exploit this by hijacking the sftunnel connection or by being a registered peer and sending a malicious command. This malicious file, once written, would be executed with root privileges. Crucially, exploitation requires the attacker to possess valid user credentials on the compromised device. Cisco has already released software updates to resolve this vulnerability. Unfortunately, there are no workarounds available to mitigate this specific issue. The security impact rating for this vulnerability is critical. The assigned CVE identifier for this vulnerability is CVE-2026-20324.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sftunn-codex-c3O4Jft2?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Management+Center+Software+s... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9cThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026.Security Impact Rating: MediumCVE: CVE-2026-20290

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Threat+Defense+Software+Sno... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Identity Services Engine Authenticated Remote Code Execution and API Vulnerabilities

Multiple vulnerabilities have been identified in Cisco Identity Services Engine (ISE). These vulnerabilities could allow an authenticated, remote attacker to perform SQL injections. Attackers could also modify data on affected devices through these vulnerabilities. Furthermore, arbitrary commands could be executed on the underlying operating system. Cisco has assigned a Security Impact Rating of Critical to the overall set of vulnerabilities. Specifically, CVE-2026-20282 and CVE-2026-20283 are rated High due to the ease of achieving root privilege from the exploited level. Cisco has released software updates to fix these vulnerabilities. Workarounds are available for one of the identified vulnerabilities. The advisory provides further details on these security issues. A complete list of related advisories and documentation on ISE security hardening is also available.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Authenticated+Remote+Co... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Identity Services Engine Command Injection Vulnerabilities

Multiple critical vulnerabilities have been discovered in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). These flaws could enable an authenticated, remote attacker to execute arbitrary commands with root privileges. To successfully exploit these vulnerabilities, the attacker must possess valid administrative credentials. Cisco has released software updates that resolve these security issues. Unfortunately, there are no temporary workarounds available to mitigate these vulnerabilities. This advisory is part of a larger release of security advisories from Cisco. Further details on these specific vulnerabilities can be found in the advisory's details section. Affected products include both Cisco ISE and ISE-PIC. The security impact rating for these vulnerabilities is classified as critical. The associated CVE identifiers are CVE-2026-20305 and CVE-2026-20306.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-e2CuZCYZ?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Command+Injection+Vulner... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability

A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.This vulnerability is due to improper resource management when handling EIGRP update messages. An attacker could exploit this vulnerability by sending crafted EIGRP updates at a high rate to an affected device. A successful exploit could allow the attacker to trigger a memory leak that will eventually cause the affected device to reload unexpectedly.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-eigrp-dos-GOhNejSjThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026.Security Impact Rating: HighCVE: CVE-2026-20222

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-eigrp-dos-GOhNejSj?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Adaptive+Security+Appliance+... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Identity Services Engine Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. One of them is known to be actively exploited. For more information, see Cisco Identity Services Engine Authentication Bypass Vulnerability. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5TThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. Security Impact Rating: CriticalCVE: CVE-2026-20130,CVE-2026-20192,CVE-2026-20194,CVE-2026-20234,CVE-2026-20237,CVE-2026-20287

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Hardening+Release%3A+S... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. Two of them are known to be actively exploited. For more information, see the following advisories: Cisco Secure Firewall Management Center Software Static Credential Vulnerability and Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhNThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. Security Impact Rating: CriticalCVE: CVE-2026-20329,CVE-2026-20330,CVE-2026-20331,CVE-2026-20332,CVE-2026-20333,CVE-2026-20334,CVE-2026-20335,CVE-2026-20336

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Adaptive+Security+Applian... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Identity Services Engine Authentication Bypass Vulnerabilities

Multiple vulnerabilities have been identified in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). These vulnerabilities could permit a remote attacker to gain unauthorized data access or manipulation. Attackers might also be able to obtain sensitive information through these flaws. Additionally, it's possible for an attacker to trigger a reload of certificate and key material on affected devices. Cisco has made software updates available to resolve these vulnerabilities. Unfortunately, there are no alternative solutions or workarounds that can mitigate these security issues. The security impact rating for these vulnerabilities has been classified as Medium. Several CVE identifiers are associated with these specific vulnerabilities. For detailed information, users should consult the provided advisory link. This advisory is part of a larger release of security updates from Cisco.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Identity+Services+Engine+Authentication+... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

A critical vulnerability exists in Cisco Secure Firewall Management Center (FMC) Software's External Database Access feature. This flaw allows unauthenticated, remote attackers to execute arbitrary commands as root on affected devices. The vulnerability stems from insecure deserialization of a user-supplied Java byte stream. Attackers can exploit this by sending a specially crafted byte stream to a specific TCP port on an affected device. Crucially, exploitation requires the attacker to control a host on the external database access list. If the FMC management interface lacks public internet access, the attack risk is lessened. Cisco has released software updates to fix this vulnerability. There are no workarounds available to mitigate this issue. The affected component is the External Database Access feature. The vulnerability is identified by CVE-2026-20242.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-javarce-y2NypXwk?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Management+Center+Software+Java+D... sec.cloudapps.cisco.com

RSS Hunter • Sep 16

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload.This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition.Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tcpdns-dos-p6dUnjr5This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of September 16, 2026, Security Advisories. In addition, for further documentation of improvements and fixes in Cisco Secure Firewall products, see Cisco Secure Firewall Adaptive Security Appliance Software, Secure Firewall Threat Defense Software, and Secure Firewall Management Center Software Hardening Release: September 2026.Security Impact Rating: MediumCVE: CVE-2026-20248

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tcpdns-dos-p6dUnjr5?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Secure+Firewall+Adaptive+Security+Appliance... sec.cloudapps.cisco.com

RSS Hunter • Sep 16