---METADATA---
VENDOR: Nagios
PRODUCT: Nagios (zabbixagent_configwizard_func)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the Nagios zabbixagent_configwizard_func component allows for remote code execution on the monitoring host.

Executive Summary:
A high-severity command injection flaw in a Nagios configuration wizard could allow remote attackers to execute arbitrary code and seize control of the monitoring server.

Vulnerability Details

CVE-ID: CVE-2026-2041

Affected Software: Nagios (specifically the Zabbix Agent Configuration Wizard)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the zabbixagent_configwizard_func function. Inadequate input validation allows an attacker to inject shell commands into the configuration process. While the JSON suggests an "ABB" vendor, the technical description points directly to a Nagios component, where such wizards typically run with elevated privileges.

Business Impact

Remote Code Execution (RCE) on a monitoring server is catastrophic, as these systems often have extensive reach into the rest of the network. An attacker could use the compromised Nagios server to pivot to other systems, steal credentials, or disrupt infrastructure monitoring. The CVSS score of 7.2 indicates a High severity risk that directly threatens the entire IT environment.

Remediation Plan

Immediate Action: Apply security patches for Nagios and the affected configuration wizard immediately. If the wizard is not in active use, disable or remove it from the system.

Proactive Monitoring: Check for unusual child processes spawning from the Nagios web service and review network traffic for unauthorized outbound connections from the monitoring host.

Compensating Controls: Restrict access to the Nagios administrative interface to specific IP addresses via a management VPN or firewall and use a WAF to filter malicious command strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation. However, RCE vulnerabilities in monitoring tools are highly prized by attackers for their ability to facilitate large-scale network compromise.

Analyst Recommendation

Apply the primary vendor patch immediately. Because monitoring systems are critical infrastructure, they must be hardened beyond just patching. Ensure that the Nagios web interface is not exposed to the public internet and that all administrative actions are strictly logged and audited.

---METADATA---
VENDOR: MediaTek
PRODUCT: imgsys
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A missing bounds check in the MediaTek imgsys component allows for a possible out-of-bounds write, potentially leading to local privilege escalation.

Executive Summary:
The MediaTek imgsys component is vulnerable to an out-of-bounds write that could allow a local attacker to compromise system memory and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-20409

Affected Software: MediaTek imgsys

Affected Versions: See vendor advisory for affected versions

Vulnerability: In the "imgsys" (imaging system) component, a missing bounds check on input data leads to an out-of-bounds write vulnerability. This flaw typically requires some level of local execution capability but allows an attacker to overwrite critical memory regions, potentially leading to arbitrary code execution within a privileged context.

Business Impact

The ability to perform an out-of-bounds write in a core hardware abstraction layer like "imgsys" is a critical security concern. With a CVSS score of 7.8, this High-severity vulnerability could be leveraged by malicious applications to bypass security sandboxes, steal sensitive user data, or gain persistent control over the device. For enterprises, this represents a significant risk to mobile device integrity and data privacy.

Remediation Plan

Immediate Action: Deploy the latest firmware and security updates from the device manufacturer (OEM) to address the underlying MediaTek driver flaw.

Proactive Monitoring: Utilize Mobile Threat Defense (MTD) solutions to detect suspicious application behavior or attempts to exploit kernel-level vulnerabilities.

Compensating Controls: Enforce strict application whitelisting and ensure that devices are not "rooted," as this significantly increases the ease of exploiting out-of-bounds write vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Vulnerabilities in imaging components are frequently targeted in "zero-click" or highly sophisticated exploit chains.

Analyst Recommendation

This vulnerability requires immediate attention due to its potential for privilege escalation. Organizations should prioritize the distribution of the latest Android security patches to all affected devices. Ensuring that hardware-level drivers are patched is essential for maintaining the overall security posture of the mobile fleet.

---METADATA---
VENDOR: Android/Chipset Vendor
PRODUCT: WLAN Driver/Component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap buffer overflow in the WLAN driver component allows for an out-of-bounds write, potentially leading to system memory corruption or arbitrary code execution.

Executive Summary:
A high-severity heap buffer overflow vulnerability in the WLAN component could allow an attacker to perform an out-of-bounds write, leading to system instability or unauthorized code execution.

Vulnerability Details

CVE-ID: CVE-2026-20408

Affected Software: Android/Chipset Vendor WLAN Driver/Component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is characterized by a heap buffer overflow within the WLAN stack, which facilitates an out-of-bounds write. This flaw typically occurs during the processing of wireless network frames and may be reachable by an unauthenticated attacker located within the radio range of the target device.

Business Impact

A successful exploit of this vulnerability could lead to a complete denial-of-service (system crash) or the execution of arbitrary code with kernel-level privileges. With a CVSS score of 8.0, this represents a high-risk scenario where the integrity and availability of the device are significantly compromised, potentially leading to full system takeover and the theft of sensitive data.

Remediation Plan

Immediate Action: Organizations and users must apply the latest security patches provided by the hardware manufacturer or OS vendor immediately to rectify the memory management flaw.

Proactive Monitoring: Security administrators should review system logs for frequent kernel panics or anomalous driver behavior that could indicate exploitation attempts or failed memory corruption attacks.

Compensating Controls: Where immediate patching is not feasible, restrict device connectivity to known, secure wireless networks and utilize mobile device management (MDM) policies to isolate high-risk assets from untrusted environments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of heap-based overflows in critical network drivers, the potential for sophisticated exploitation remains high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, as flaws in low-level drivers like WLAN often bypass standard application-layer security controls. It is highly recommended that IT administrators prioritize the deployment of vendor-supplied firmware or OS updates across all affected devices to eliminate the risk of remote code execution.

---METADATA---
VENDOR: wlan
PRODUCT: STA driver
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A missing bounds check in the wlan STA driver allows for local escalation of privilege through a potential buffer overflow or memory corruption.

Executive Summary:
A missing bounds check in the wlan STA driver could allow a local attacker to achieve elevated system privileges on affected devices.

Vulnerability Details

CVE-ID: CVE-2026-20407

Affected Software: wlan STA driver

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability stems from a lack of proper bounds checking within the wlan STA driver code. A local attacker can exploit this deficiency to cause memory corruption, facilitating an escalation of privilege from a standard user to a higher-level system or root account.

Business Impact

With a CVSS score of 8.8, this vulnerability is considered High severity. Successful exploitation allows an attacker to gain deep access to the operating system, potentially leading to the installation of persistent malware, theft of sensitive data, or complete system takeover. In an enterprise environment, this could compromise the security of mobile workstations and IoT devices.

Remediation Plan

Immediate Action: Apply the specific security updates provided by the hardware or OS vendor to fix the driver's bounds checking logic.

Proactive Monitoring: Review system crash reports and kernel logs for signatures related to wlan driver instability, which may indicate exploit attempts.

Compensating Controls: Use endpoint detection and response (EDR) tools to monitor for suspicious privilege escalation behavior and restrict the loading of unauthorized drivers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Driver-level vulnerabilities are highly valuable to attackers seeking to bypass OS-level security features.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations should identify all devices utilizing the affected wlan STA driver and deploy the necessary patches. Failure to remediate this vulnerability leaves the system open to sophisticated local attacks that can bypass standard security boundaries.

---METADATA---
VENDOR: Modem Manufacturer
PRODUCT: Modem Firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An uncaught exception in modem firmware can lead to a system crash, resulting in a denial of service.

Executive Summary:
Modem firmware contains an uncaught exception vulnerability that can be exploited to cause a system crash and disrupt all network traffic.

Vulnerability Details

CVE-ID: CVE-2026-20406

Affected Software: Modem Firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an uncaught exception within the modem's firmware. When the firmware encounters an unexpected error condition that is not properly handled, the system terminates the process or crashes entirely. This can likely be triggered by an unauthenticated remote attacker.

Business Impact

The impact is a complete Denial of Service (DoS) for the affected modem. The CVSS score of 7.5 indicates a High-severity risk to availability, which is critical for maintaining reliable network infrastructure and avoiding business downtime.

Remediation Plan

Immediate Action: Apply the latest firmware updates from the vendor to ensure that all exceptions are properly caught and handled by the system.

Proactive Monitoring: Monitor device logs for unhandled exception errors and track frequency of service restarts.

Compensating Controls: Isolate the modem's control plane from the data plane where possible and restrict management access to secure, authenticated channels.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Uncaught exceptions are often the result of edge cases in protocol handling that can be discovered through targeted testing.

Analyst Recommendation

We recommend the immediate application of firmware patches. Ensuring the stability of the modem's operating environment is vital for preventing intentional or accidental service outages.

---METADATA---
VENDOR: Modem Manufacturer
PRODUCT: Modem Firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Modem firmware is susceptible to a system crash due to a missing bounds check, which can be triggered by malformed input.

Executive Summary:
A missing bounds check in modem firmware allows for a system crash, creating a significant Denial of Service risk for the affected hardware.

Vulnerability Details

CVE-ID: CVE-2026-20405

Affected Software: Modem Firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from a missing bounds check within the modem's firmware components. By sending crafted data that exceeds expected limits, an unauthenticated attacker can trigger a crash of the modem's operating system.

Business Impact

The resulting system crash leads to a total loss of network availability for the affected device. The CVSS score of 7.5 reflects the high impact on business continuity, as communication failures can prevent access to cloud services, remote offices, and customer-facing applications.

Remediation Plan

Immediate Action: Deploy the manufacturer's firmware update that specifically addresses the missing bounds check vulnerability.

Proactive Monitoring: Implement automated alerts for device downtime to ensure rapid response if a DoS attack occurs.

Compensating Controls: Use intrusion prevention systems (IPS) to detect and drop packets that exhibit characteristics of buffer overflow or bounds-violation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, bounds-check failures are a classic vulnerability type that is easily discovered by fuzzing tools.

Analyst Recommendation

Immediate patching is the only effective mitigation. IT administrators should verify the firmware versions of all deployed modems and update any that are running vulnerable software to prevent service interruptions.

---METADATA---
VENDOR: Modem Manufacturer
PRODUCT: Modem Firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Improper input validation in modem firmware allows for a possible system crash, leading to a denial of service condition.

Executive Summary:
A High-severity input validation vulnerability in modem firmware could be exploited to crash the system and disrupt network connectivity.

Vulnerability Details

CVE-ID: CVE-2026-20404

Affected Software: Modem Firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The firmware fails to properly validate input data, which can lead to an unstable state and an eventual system crash. This vulnerability is likely accessible to unauthenticated attackers who can send malformed data to the device.

Business Impact

An exploit would cause a complete loss of availability for the affected modem. With a CVSS score of 7.5, the impact is significant for organizations that depend on continuous connectivity, as a crash can halt data transfers and interrupt business-critical services.

Remediation Plan

Immediate Action: Update the modem firmware to the most recent version provided by the vendor to fix the input validation routine.

Proactive Monitoring: Review system logs for error messages related to input processing and monitor for patterns of frequent device resets.

Compensating Controls: Place modem management interfaces behind a firewall and limit access to authorized IP addresses to minimize exposure to external attackers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. The risk remains high as DoS attacks are often used as a precursor to more complex network intrusions.

Analyst Recommendation

Apply the vendor's security update immediately. Maintaining up-to-date firmware is a critical component of a defense-in-depth strategy, particularly for hardware that serves as a gateway to the network.

---METADATA---
VENDOR: Modem Manufacturer
PRODUCT: Modem Firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A missing bounds check in modem firmware creates a vulnerability that can result in a system crash and denial of service.

Executive Summary:
Modem firmware is vulnerable to a system crash due to a missing bounds check, posing a high risk of service disruption.

Vulnerability Details

CVE-ID: CVE-2026-20403

Affected Software: Modem Firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is caused by a missing bounds check in the modem firmware's memory management or packet processing logic. An attacker could potentially trigger this flaw without authentication, leading to a system crash.

Business Impact

The primary impact is a Denial of Service (DoS), as the system crash forces the modem to become inoperative until it is manually or automatically rebooted. The CVSS score of 7.5 highlights the severity of this availability risk, which can lead to significant downtime for critical communication links.

Remediation Plan

Immediate Action: Install the latest firmware patch from the manufacturer that implements the necessary bounds checking.

Proactive Monitoring: Use network monitoring tools to track device uptime and investigate any sudden, unexplained reboots of modem hardware.

Compensating Controls: Implement network-level filtering to block malformed packets that might be used to trigger memory-related vulnerabilities in edge devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Missing bounds checks are common targets for researchers and threat actors seeking to find stable DoS vectors.

Analyst Recommendation

Administrators should immediately apply the vendor's firmware updates. Ensuring that all networking hardware is running current, patched firmware is essential for protecting against DoS attacks that target basic protocol handling.

---METADATA---
VENDOR: Modem Manufacturer
PRODUCT: Modem Firmware
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A modem firmware vulnerability involving improper input validation can lead to a possible system crash and denial of service.

Executive Summary:
A critical input validation flaw in certain modem firmware could allow an attacker to cause a total system crash, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-20402

Affected Software: Modem Firmware

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The modem firmware suffers from an improper input validation vulnerability. An attacker, likely unauthenticated via the network, can provide specially crafted input that the system fails to handle correctly, leading to a system crash.

Business Impact

A successful exploit results in a complete system crash, causing a Denial of Service (DoS) for all connected users and services. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, potentially disrupting critical communications and business operations that rely on the affected modem hardware.

Remediation Plan

Immediate Action: Apply the firmware update provided by the modem manufacturer immediately to resolve the input validation logic error.

Proactive Monitoring: Monitor network infrastructure for unexpected device reboots or connectivity drops that could indicate exploitation attempts.

Compensating Controls: Restrict access to the modem's management interfaces to trusted internal networks only, reducing the attack surface available to external threats.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, DoS vulnerabilities in networking hardware are frequently targeted to disrupt infrastructure.

Analyst Recommendation

The primary recommendation is to update the modem firmware to the latest secure version. Given the High severity (CVSS 7.5), administrators should prioritize these updates to maintain the stability and availability of their network communications.

---METADATA---
VENDOR: Cisco
PRODUCT: Crosswork Planning
AFFECTED_VERSIONS: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Crosswork Planning contains multiple vulnerabilities related to insufficiently protected credentials, which may allow for unauthorized access or system compromise.

Executive Summary:
Cisco Crosswork Planning is affected by a critical vulnerability involving improper credential protection that poses a significant risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-20359

Affected Software: Cisco Crosswork Planning

Affected Versions: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0

Vulnerability: This issue is classified as CWE-522, involving insufficiently protected credentials. The vulnerability requires the attacker to hold low-level privileges (PR:L) to exploit, potentially leading to a full system compromise.

Business Impact

Successful exploitation of this vulnerability could lead to total loss of confidentiality, integrity, and availability of the affected system. Given the CVSS score of 9.9, this represents an extreme risk to organizational data and infrastructure, potentially resulting in unauthorized administrative access and deep-seated system compromise.

Remediation Plan

Immediate Action: Update Cisco Crosswork Planning to the latest version provided by the vendor to remediate the credential handling flaws.

Proactive Monitoring: Monitor system access logs for anomalous behavior or unauthorized attempts to access administrative functions.

Compensating Controls: Ensure strict network segmentation and apply the principle of least privilege to restrict the impact of potential unauthorized access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score reflects the potential for severe impact if an attacker with low-level access successfully leverages these credential flaws.

Analyst Recommendation

The severity of this vulnerability is critical, and organizations using Cisco Crosswork Planning must prioritize the application of the vendor-supplied security updates. Immediate patching is the most effective way to secure the environment against potential exploitation of these credential protection weaknesses.

---METADATA---
VENDOR: Cisco
PRODUCT: Crosswork Planning
AFFECTED_VERSIONS: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An external control of file system path vulnerability in Cisco Crosswork Planning allows remote attackers to manipulate file operations.

Executive Summary:
Cisco Crosswork Planning is susceptible to unauthorized file system manipulation, which could lead to critical system impact and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-20358

Affected Software: Cisco Crosswork Planning

Affected Versions: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0

Vulnerability: This vulnerability is classified as external control of file name or path (CWE-73). It allows an unauthenticated remote attacker to influence file system operations, potentially resulting in unauthorized file modification or deletion.

Business Impact

With a CVSS score of 10.0, this vulnerability presents a critical threat to system integrity and availability. An attacker could potentially overwrite configuration files or execute arbitrary code through file system manipulation, leading to a complete compromise of the application environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of Cisco Crosswork Planning as recommended by the vendor.

Proactive Monitoring: Monitor file system integrity and review logs for suspicious file access patterns or unauthorized path traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal characters or suspicious file path patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly dangerous if an attacker gains the ability to manipulate system-critical files.

Analyst Recommendation

This vulnerability demands immediate attention due to its potential for total system compromise. Administrators should apply the vendor-provided security patches as soon as they become available to prevent exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Crosswork Planning
AFFECTED_VERSIONS: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authentication vulnerability in Cisco Crosswork Planning allows unauthenticated remote attackers to execute critical functions.

Executive Summary:
Cisco Crosswork Planning is vulnerable to an unauthenticated critical function access flaw, posing a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-20357

Affected Software: Cisco Crosswork Planning

Affected Versions: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.2.0

Vulnerability: This vulnerability involves missing authentication for critical functions (CWE-306). The flaw allows an unauthenticated, remote attacker to interact with sensitive system components without providing valid credentials.

Business Impact

The CVSS score of 10.0 reflects the highest level of severity, indicating that this vulnerability could lead to a complete takeover of the affected system. Successful exploitation would result in unauthorized access, potential data exfiltration, and full operational disruption, causing significant reputational and financial damage.

Remediation Plan

Immediate Action: Update Cisco Crosswork Planning to the latest version as specified in the vendor security advisory.

Proactive Monitoring: Review system access logs for unusual administrative activity or requests originating from unauthorized network segments.

Compensating Controls: Implement strict network segmentation and restrict access to the management interface of the application to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an extremely attractive target for attackers.

Analyst Recommendation

Given the critical CVSS severity rating, organizations must prioritize patching this vulnerability immediately. Failure to apply the necessary updates exposes the environment to unauthenticated remote code execution and total system takeover.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
AFFECTED_VERSIONS: ASA: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14; FTD: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Cisco Secure Firewall ASA and FTD contain a heap inspection vulnerability due to improper memory clearing, which is currently being exploited in the wild.

Executive Summary:
This critical heap inspection vulnerability in Cisco Secure Firewall ASA and FTD is being actively exploited in the wild and poses a significant risk to network infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-20349

Affected Software: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

Affected Versions: ASA: 9.16.1, 9.16.1.28, 9.16.2, 9.16.2.3, 9.16.2.7, 9.16.2.11, 9.16.2.13, 9.16.2.14; FTD: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3

Vulnerability: The software fails to properly clear heap memory before release, allowing unauthenticated remote attackers to perform heap inspection.

Business Impact

Successful exploitation of this flaw can lead to a denial of service or potential information disclosure, impacting the availability and confidentiality of critical network security infrastructure. Given the CVSS score of 9.5 and confirmed active exploitation, this vulnerability represents an immediate threat to the integrity of enterprise perimeter defenses.

Remediation Plan

Immediate Action: Apply the vendor-provided updates or mitigations immediately as outlined in the official Cisco security advisory.

Proactive Monitoring: Monitor firewall logs for unusual spikes in resource consumption or unexpected process restarts that may indicate exploitation attempts.

Compensating Controls: Ensure perimeter defenses are strictly controlled and limit management interface access to trusted administrative networks only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 11, 2026. The nature of this heap inspection flaw makes it a high-value target for remote attackers seeking to disrupt security operations.

Analyst Recommendation

Due to the confirmed active exploitation and the critical nature of the affected software, immediate action is required. Organizations must prioritize the deployment of vendor-supplied patches or mitigations to prevent unauthorized access or system disruption.

---METADATA---
VENDOR: Cisco
PRODUCT: Cisco Secure Endpoint
AFFECTED_VERSIONS: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the ClamAV XAR parser within Cisco Secure Endpoint allows unauthenticated remote attackers to trigger a denial of service condition.

Executive Summary:
A remote, unauthenticated denial of service vulnerability in Cisco Secure Endpoint, caused by improper XAR file parsing, poses a significant availability risk to protected systems.

Vulnerability Details

CVE-ID: CVE-2026-20348

Affected Software: Cisco Secure Endpoint

Affected Versions: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5

Vulnerability: This vulnerability is a classic buffer overflow (CWE-120) found within the ClamAV XAR file format parser. An unauthenticated remote attacker can exploit this by submitting a malicious XAR file to the endpoint, causing memory corruption that leads to service failure.

Business Impact

The CVSS score of 7.5 reflects a high-severity threat to system availability. By exploiting this flaw, an attacker can force the security software to crash, which prevents the endpoint from performing its primary function and potentially exposes the host to further, unmonitored malicious activity.

Remediation Plan

Immediate Action: Follow the guidance provided in the Cisco security advisory to patch the affected versions of Cisco Secure Endpoint.

Proactive Monitoring: Implement logging for critical service status to identify sudden terminations of the ClamAV process that could indicate exploit attempts.

Compensating Controls: Restrict the ingestion of XAR files from untrusted external sources at the network perimeter until patches are successfully deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Buffer overflow vulnerabilities remain a high-risk category due to the potential for memory corruption leading to system instability.

Analyst Recommendation

Security teams should prioritize the application of vendor updates for this vulnerability. Because this is a high-severity issue that is reachable without authentication, failure to patch could leave systems vulnerable to simple denial of service attacks that disrupt critical security operations.

---METADATA---
VENDOR: Cisco
PRODUCT: Cisco Secure Endpoint
AFFECTED_VERSIONS: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the ClamAV Mach-O parser within Cisco Secure Endpoint allows unauthenticated remote attackers to trigger a denial of service condition.

Executive Summary:
A remote, unauthenticated denial of service vulnerability in Cisco Secure Endpoint, caused by improper Mach-O file parsing, poses a significant availability risk to protected systems.

Vulnerability Details

CVE-ID: CVE-2026-20347

Affected Software: Cisco Secure Endpoint

Affected Versions: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5

Vulnerability: This vulnerability is an out-of-bounds read (CWE-125) within the ClamAV Mach-O file format parser. An unauthenticated remote attacker can trigger this flaw by sending a crafted Mach-O file to the target, resulting in memory corruption and a denial of service state.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a high risk to business continuity. Because it does not require authentication, attackers can remotely disable security features on targeted endpoints, effectively blinding the organization to other potential threats while the service is unavailable.

Remediation Plan

Immediate Action: Consult the Cisco security advisory referenced in the metadata and apply the recommended software updates as soon as they become available.

Proactive Monitoring: Review security logs for anomalous file scan activity or repeated process failures within the Cisco Secure Endpoint service.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to monitor for suspicious file-processing behavior and restrict incoming traffic from untrusted sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible to remote actors, making the prevention of service disruption a priority.

Analyst Recommendation

Organizations should treat this vulnerability as a high-priority item. Administrators must monitor for vendor-provided patches and apply them to all affected Cisco Secure Endpoint installations to maintain system integrity and availability.

---METADATA---
VENDOR: Cisco
PRODUCT: Cisco Secure Endpoint
AFFECTED_VERSIONS: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory corruption vulnerability in the ClamAV PDF parser within Cisco Secure Endpoint allows unauthenticated remote attackers to trigger a denial of service condition.

Executive Summary:
A remote, unauthenticated denial of service vulnerability in Cisco Secure Endpoint, caused by improper PDF parsing, poses a significant availability risk to protected systems.

Vulnerability Details

CVE-ID: CVE-2026-20346

Affected Software: Cisco Secure Endpoint

Affected Versions: 6.1.5, 6.2.5, 6.2.19, 6.3.1, 7.0.5, 7.2.13, 7.3.3, 7.3.5

Vulnerability: This vulnerability is an out-of-bounds read (CWE-125) occurring within the ClamAV PDF file parser. An unauthenticated remote attacker can exploit this by sending a specially crafted PDF file to the target device, leading to memory corruption and subsequent service disruption.

Business Impact

The CVSS score of 7.5 indicates a high severity risk primarily targeting system availability. Successful exploitation results in a denial of service, which can cause significant operational downtime for organizations relying on Cisco Secure Endpoint for critical threat detection and infrastructure protection.

Remediation Plan

Immediate Action: Review the official Cisco security advisory for available updates and apply the necessary patches to all affected endpoints immediately.

Proactive Monitoring: Monitor system logs for unexpected service crashes or restarts of the ClamAV scanning engine, which may indicate attempted exploitation.

Compensating Controls: Deploy network-based inspection or Web Application Firewalls (WAF) to filter malformed PDF traffic before it reaches the scanning engine, provided such traffic can be identified.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its network-accessible nature and the lack of authentication required for triggers.

Analyst Recommendation

Given the high CVSS score and the potential for remote disruption, this vulnerability should be prioritized for remediation. IT administrators must verify their current version against the provided list and coordinate with Cisco support to ensure the latest secure versions are deployed across the enterprise environment.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Endpoint
AFFECTED_VERSIONS: 1.12.3, 1.8.0, 1.11.1, 1.12.4, 1.10.0, 1.12.0, 1.8.1, 1.10.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the ClamAV GPT file parser within Cisco Secure Endpoint allows an unauthenticated, remote attacker to trigger memory corruption and denial of service.

Executive Summary:
A high-severity stack-based buffer overflow in the ClamAV parser of Cisco Secure Endpoint enables unauthenticated, remote attackers to trigger memory corruption, leading to service disruption.

Vulnerability Details

CVE-ID: CVE-2026-20345

Affected Software: Cisco Secure Endpoint

Affected Versions: 1.12.3, 1.8.0, 1.11.1, 1.12.4, 1.10.0, 1.12.0, 1.8.1, 1.10.1

Vulnerability: This vulnerability involves a stack-based buffer overflow (CWE-121) in the GPT file format parser. By delivering a specially crafted file, an unauthenticated, remote attacker can cause memory corruption, leading to a denial of service or other expanded impacts on the affected device.

Business Impact

A stack-based buffer overflow is a critical flaw that can lead to system crashes or arbitrary code execution. Given the CVSS score of 7.5, this represents a major risk to business continuity and data security, as the exploitation of this component could render the endpoint defenseless against further malicious activity.

Remediation Plan

Immediate Action: Visit the Cisco security advisory link provided in the enrichment data to identify the specific update path and apply the necessary patches.

Proactive Monitoring: Monitor for unexpected process crashes related to the Cisco Secure Endpoint agent and investigate any suspicious file activity.

Compensating Controls: Deploy WAF or network-based file scanning solutions to detect and quarantine malformed GPT files before they are parsed by the endpoint agent.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Stack-based overflows are dangerous, and timely patching is the only reliable method to eliminate the risk of exploitation.

Analyst Recommendation

Organizations must treat this vulnerability with high priority. Update all affected instances of Cisco Secure Endpoint to the latest patched version to ensure that memory corruption vulnerabilities in the ClamAV engine are effectively neutralized.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Endpoint
AFFECTED_VERSIONS: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An integer overflow vulnerability in the ClamAV PESpin file parser within Cisco Secure Endpoint allows an unauthenticated, remote attacker to trigger memory corruption and denial of service.

Executive Summary:
A high-severity integer overflow vulnerability in the ClamAV parser of Cisco Secure Endpoint permits unauthenticated, remote attackers to cause memory corruption or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-20339

Affected Software: Cisco Secure Endpoint

Affected Versions: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5

Vulnerability: The issue resides in the PESpin file format parser and is characterized by an integer overflow or wraparound (CWE-190). This flaw allows an unauthenticated, remote attacker to trigger memory corruption, which may result in a denial of service or other impacts on the device.

Business Impact

The ability for a remote, unauthenticated attacker to induce memory corruption creates a severe stability and potential security risk. With a CVSS score of 7.5, this vulnerability could be leveraged to disable security defenses, resulting in increased risk of unauthorized access or broader compromise during the period of service unavailability.

Remediation Plan

Immediate Action: Consult the Cisco security advisory referenced in the metadata and update the Cisco Secure Endpoint software to the latest secure version.

Proactive Monitoring: Review security logs for anomalous file parsing errors or service termination events.

Compensating Controls: Utilize perimeter security tools to inspect incoming files for malformed PESpin headers to prevent the exploit from reaching the endpoint agent.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory corruption flaws of this nature often require precise payload construction for successful exploitation.

Analyst Recommendation

Because this vulnerability impacts a core security component, it is imperative that organizations apply the vendor-provided patches as soon as they become available. Failure to remediate could allow attackers to bypass endpoint security controls via targeted file-based attacks.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Endpoint
AFFECTED_VERSIONS: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A double free vulnerability in the ClamAV zip archive parser within Cisco Secure Endpoint allows an unauthenticated, remote attacker to trigger a denial of service condition.

Executive Summary:
A high-severity double free vulnerability in the ClamAV component of Cisco Secure Endpoint enables unauthenticated, remote attackers to crash the service, leading to potential denial of service.

Vulnerability Details

CVE-ID: CVE-2026-20338

Affected Software: Cisco Secure Endpoint

Affected Versions: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5

Vulnerability: The flaw exists in the zip archive parser and is caused by a double free memory error (CWE-415). An unauthenticated, remote attacker can exploit this via specially crafted files to cause a service crash.

Business Impact

Successful exploitation results in a denial of service, which disrupts the protective capabilities of the Cisco Secure Endpoint agent. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to endpoint security posture, potentially leaving systems vulnerable to other threats while the security software is unresponsive.

Remediation Plan

Immediate Action: Review the official Cisco security advisory at the link provided in the enrichment data and apply the recommended software updates to move beyond the affected versions.

Proactive Monitoring: Monitor system logs for unexpected crashes or restarts of the Cisco Secure Endpoint service.

Compensating Controls: Ensure that network-level traffic inspection is active to identify and block malformed zip archives before they reach the endpoint agent.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by sending a malicious file to the parser.

Analyst Recommendation

The reliance on a vulnerable library within security software creates a critical availability risk. Administrators should prioritize patching these specific versions of Cisco Secure Endpoint immediately to restore full service stability and security integrity.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Endpoint
AFFECTED_VERSIONS: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the zip archive parser of ClamAV, utilized by Cisco Secure Endpoint, allows unauthenticated remote attackers to cause a denial of service condition.

Executive Summary:
A high-severity buffer overflow vulnerability in the Cisco Secure Endpoint ClamAV parser allows unauthenticated remote attackers to trigger a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-20337

Affected Software: Cisco Secure Endpoint

Affected Versions: 7.0.5, 6.2.19, 7.3.3, 7.2.13, 6.1.5, 6.3.1, 6.2.5, 7.3.5

Vulnerability: The vulnerability is a classic buffer overflow (CWE-120) located in the zip archive parser of ClamAV. An unauthenticated remote attacker can supply a maliciously crafted archive to cause the service to crash, resulting in a denial of service.

Business Impact

While the vulnerability only results in a denial of service, it impacts security infrastructure critical to identifying malicious files. The CVSS score of 7.5 reflects the high impact on service availability, which could leave an organization temporarily without malware protection, creating a window of opportunity for other attacks.

Remediation Plan

Immediate Action: Update Cisco Secure Endpoint to the latest patched version as provided in the official Cisco security advisory.

Proactive Monitoring: Monitor system logs for repeated service crashes or unexpected restarts of the ClamAV scanning engine.

Compensating Controls: Use network-level filtering to block suspicious zip archive files from reaching protected endpoints until the patch can be deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Security teams should prioritize the deployment of the vendor-supplied update. Maintaining the integrity of endpoint protection software is essential, and resolving this denial of service vulnerability is necessary to prevent potential blind spots in security coverage.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Workload
AFFECTED_VERSIONS: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Secure Workload contains an improper authentication vulnerability that may allow unauthenticated remote attackers to bypass authentication and execute unauthorized actions.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Secure Workload allows unauthenticated remote attackers to perform unauthorized actions, threatening the integrity and availability of the system.

Vulnerability Details

CVE-ID: CVE-2026-20317

Affected Software: Cisco Secure Workload

Affected Versions: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34

Vulnerability: The software suffers from an improper authentication issue (CWE-287), where security checks can be bypassed by remote attackers. The CVSS vector indicates that the attacker does not need authentication or user interaction to exploit this flaw.

Business Impact

An attacker could potentially bypass security controls to perform unauthorized administrative operations, leading to significant business impact, including system disruption or unauthorized configuration changes. The CVSS score of 10.0 reflects the critical risk this vulnerability poses to the confidentiality, integrity, and availability of managed workloads.

Remediation Plan

Immediate Action: Upgrade all instances of Cisco Secure Workload to the latest patched version released by Cisco to close the authentication bypass vulnerability.

Proactive Monitoring: Audit authentication logs for unusual login patterns or attempts to perform administrative functions without a valid session.

Compensating Controls: Restrict network access to the management console to authorized internal IP addresses only, reducing the attack surface available to external threats.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly critical due to the ability for an unauthenticated attacker to bypass authentication mechanisms.

Analyst Recommendation

Organizations must prioritize the remediation of this authentication vulnerability. Given the critical severity and the potential for unauthenticated access, immediate application of the vendor patch is required to secure the environment against potential exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Management Center (FMC)
AFFECTED_VERSIONS: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A hard-coded password vulnerability in Cisco Secure Firewall Management Center allows unauthenticated attackers to potentially bypass security controls.

Executive Summary:
This vulnerability involves a hard-coded password in Cisco Secure Firewall Management Center and is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-20316

Affected Software: Cisco Secure Firewall Management Center (FMC)

Affected Versions: 7.0.0, 7.0.0.1, 7.0.1, 7.0.1.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3

Vulnerability: This flaw stems from the presence of a hard-coded password within the application, which may allow an unauthenticated attacker to gain unauthorized access or influence system operations.

Business Impact

The presence of a hard-coded credential in a security management platform poses a severe risk to the entire network infrastructure. Given the CVSS score of 9.5, successful exploitation could lead to full compromise of the security appliance, potentially exposing internal network traffic or enabling lateral movement.

Remediation Plan

Immediate Action: Apply the vendor-supplied security updates or mitigations immediately, as this vulnerability is confirmed to be under active exploitation.

Proactive Monitoring: Review system logs for unauthorized access attempts or unusual administrative activity originating from unexpected IP addresses.

Compensating Controls: Ensure the Management Center is not exposed to the public internet and restrict access to the management interface to trusted management subnets only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of July 29, 2026. The nature of this flaw represents a critical failure in access control, necessitating immediate remediation.

Analyst Recommendation

The active exploitation of this vulnerability in the wild makes it a top-tier priority. Organizations must verify their FMC version against the affected list and apply the official Cisco patches without delay to prevent unauthorized access to their security management environment.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Workload
AFFECTED_VERSIONS: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Secure Workload contains an improper access control vulnerability that may allow unauthenticated remote attackers to bypass security restrictions and compromise the system.

Executive Summary:
A critical access control vulnerability in Cisco Secure Workload allows unauthenticated remote attackers to gain unauthorized access, potentially leading to total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-20315

Affected Software: Cisco Secure Workload

Affected Versions: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34

Vulnerability: This vulnerability (CWE-284) stems from improper access control mechanisms that fail to enforce security boundaries. The CVSS vector confirms that the flaw is remotely exploitable without authentication or user interaction.

Business Impact

Exploitation of this vulnerability grants attackers unauthorized access to sensitive workload management environments, risking data integrity and confidentiality. With a CVSS score of 10.0, this issue presents a severe threat to the security posture of the entire network infrastructure managed by this platform.

Remediation Plan

Immediate Action: Apply the vendor-supplied security update to the affected Cisco Secure Workload instances immediately to resolve the access control deficiency.

Proactive Monitoring: Monitor system access logs for unauthorized administrative activity or unexpected attempts to access restricted management endpoints.

Compensating Controls: Implement strict network segmentation and restrict access to the Secure Workload management interfaces via VPN or IP allowlisting to limit exposure to untrusted networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it permits remote, unauthenticated access.

Analyst Recommendation

The critical severity of this vulnerability necessitates an immediate patch management cycle. Security teams should verify that all identified versions of Cisco Secure Workload are updated to the latest secure release to prevent potential unauthorized access.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Controller and Manager
AFFECTED_VERSIONS: Catalyst SD-WAN Controller (20.6.4, 20.9.2, 20.3.6, 20.7.2, 20.7.1, 20.5.1, 20.6.2, 19.3.0), Catalyst SD-WAN Manager (20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Cisco Catalyst SD-WAN components allows for the cleartext storage of sensitive information, potentially exposing credentials or configuration data to unauthorized access.

Executive Summary:
A vulnerability in the Cisco Catalyst SD-WAN suite enables the cleartext storage of sensitive data, posing a significant risk of credential and configuration exposure to authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-20312

Affected Software: Cisco Catalyst SD-WAN Controller and Manager

Affected Versions: See metadata for full list of affected versions.

Vulnerability: This is a cleartext storage of sensitive information issue (CWE-312) that can be triggered by a remote, authenticated user with low privileges (PR:L). The attacker does not require user interaction to exploit this flaw.

Business Impact

The exposure of sensitive information stored in cleartext can lead to a complete compromise of the SD-WAN management infrastructure. With a CVSS score of 8.8, this high-severity vulnerability allows an attacker to gain elevated access or extract configuration secrets, potentially impacting the confidentiality, integrity, and availability of the entire software-defined network.

Remediation Plan

Immediate Action: Consult the official Cisco security advisory for the specific patch version corresponding to your deployment and apply the update immediately.

Proactive Monitoring: Review system and access logs for unusual administrative activity or unauthorized attempts to access configuration files and sensitive directories.

Compensating Controls: Implement strict access control lists to limit the number of users who can interact with the SD-WAN management interface, thereby reducing the pool of potential attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the storage mechanisms of the affected software versions.

Analyst Recommendation

Given the high CVSS score and the critical nature of SD-WAN infrastructure, organizations must prioritize patching this vulnerability. Administrators should verify their current version against the affected list and schedule maintenance windows to apply the necessary vendor-provided security updates to prevent potential credential theft.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Controller and Manager
AFFECTED_VERSIONS: Catalyst SD-WAN Controller: 20.6.4, 20.9.2, 20.3.6, 20.7.2, 20.7.1, 20.5.1, 20.6.2, 19.3.0; Catalyst SD-WAN Manager: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Catalyst SD-WAN components are vulnerable to improper access control, which could allow an authenticated attacker to gain unauthorized privileges.

Executive Summary:
Critical access control vulnerabilities in Cisco Catalyst SD-WAN software create a high risk for privilege escalation and unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-20304

Affected Software: Cisco Catalyst SD-WAN Controller and Manager

Affected Versions: 20.6.4, 20.9.2, 20.3.6, 20.7.2, 20.7.1, 20.5.1, 20.6.2, 19.3.0 (Controller); 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2 (Manager)

Vulnerability: This issue stems from improper access control (CWE-284), where a user with low privileges may be able to perform unauthorized actions or access restricted system areas.

Business Impact

This vulnerability carries a CVSS score of 9.9, indicating that it could result in a total compromise of the affected environment. Unauthorized access to SD-WAN management functions could allow attackers to alter network routing, intercept traffic, or gain persistent control over the infrastructure, causing severe operational and security damage.

Remediation Plan

Immediate Action: Update all Cisco Catalyst SD-WAN Controller and Manager instances to the latest version provided by Cisco to remediate the access control flaws.

Proactive Monitoring: Monitor management interfaces for suspicious privilege escalation attempts or unauthorized configuration changes.

Compensating Controls: Restrict administrative access to the SD-WAN controller using multi-factor authentication and role-based access controls to minimize the impact of a compromised account.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the potential for total system impact makes this a high-priority risk.

Analyst Recommendation

Organizations should treat this vulnerability with the utmost urgency. Schedule and perform the recommended software updates immediately to prevent potential privilege escalation and ensure the integrity of the network management plane.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Controller and Manager
AFFECTED_VERSIONS: Catalyst SD-WAN Controller: 20.6.4, 20.9.2, 20.3.6, 20.7.2, 20.7.1, 20.5.1, 20.6.2, 19.3.0; Catalyst SD-WAN Manager: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco Catalyst SD-WAN components are vulnerable to improper input validation, which could allow an authenticated attacker to compromise the system.

Executive Summary:
Critical input validation vulnerabilities in Cisco Catalyst SD-WAN software pose a severe risk of unauthorized system control and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-20303

Affected Software: Cisco Catalyst SD-WAN Controller and Manager

Affected Versions: 20.6.4, 20.9.2, 20.3.6, 20.7.2, 20.7.1, 20.5.1, 20.6.2, 19.3.0 (Controller); 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2 (Manager)

Vulnerability: This vulnerability involves improper input validation (CWE-20) within the SD-WAN infrastructure, requiring an attacker to have low-level access to the environment to trigger the flaw.

Business Impact

Successful exploitation allows for full control over the SD-WAN infrastructure, potentially leading to unauthorized data access, network disruption, and total system compromise. With a CVSS score of 9.9, this vulnerability represents a critical threat that could lead to significant operational downtime or the exposure of sensitive network traffic.

Remediation Plan

Immediate Action: Update the affected Cisco Catalyst SD-WAN Controller and Manager instances to the versions specified in the official Cisco security advisory.

Proactive Monitoring: Review system access logs for anomalous input patterns or unexpected administrative behavior originating from authorized accounts.

Compensating Controls: Implement strict network segmentation and apply firewall rules to limit access to management interfaces to only necessary administrative IP addresses.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high severity score, but it currently lacks confirmed public exploit code.

Analyst Recommendation

Given the critical CVSS score of 9.9, organizations must prioritize patching these systems during the next maintenance window. Apply the vendor-provided software updates immediately to neutralize the risk of unauthorized system-wide control.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS and IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d, 15.2(7)E7, 15.2(8)E3, 15.7(3)M10, 15.8(3)M9, 15.9(3)M7, 15.2(7)E8, 15.2(8)E4, 15.9(3)M7a
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Extensible Messaging Client Protocol of Cisco IOS and IOS XE Software allows an unauthenticated remote attacker to cause a denial of service on an affected device.

Executive Summary:
An unauthenticated, remote denial of service vulnerability in Cisco IOS and IOS XE Software poses a high risk to network availability.

Vulnerability Details

CVE-ID: CVE-2026-20301

Affected Software: Cisco IOS and IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d, 15.2(7)E7, 15.2(8)E3, 15.7(3)M10, 15.8(3)M9, 15.9(3)M7, 15.2(7)E8, 15.2(8)E4, 15.9(3)M7a

Vulnerability: This vulnerability, identified as CWE-606 (Unchecked Input for Loop Condition), exists within the Extensible Messaging Client Protocol. An unauthenticated remote attacker can trigger this flaw to crash the device, leading to a denial of service.

Business Impact

Successful exploitation results in the loss of device availability, which can disrupt critical network infrastructure and communication services. Given the CVSS score of 8.6, the potential for significant operational downtime is high, necessitating urgent attention to maintain service level agreements and network stability.

Remediation Plan

Immediate Action: Update the affected Cisco IOS and IOS XE software to the latest versions recommended in the official Cisco security advisory.

Proactive Monitoring: Monitor network device logs for unusual spikes in traffic directed at the Extensible Messaging Client Protocol or unexpected device reboots.

Compensating Controls: Restrict access to the management interface and relevant protocols to trusted management subnets using Access Control Lists (ACLs) to mitigate unauthorized attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered remotely without authentication.

Analyst Recommendation

The severity of this issue demands immediate remediation. Security teams should prioritize patching affected Cisco devices to prevent potential service disruptions. If immediate patching is not feasible, apply restrictive ACLs to limit exposure to the impacted protocol.

---METADATA---
VENDOR: Splunk
PRODUCT: Splunk Enterprise
AFFECTED_VERSIONS: 10.4.0-10.4.0, 10.2.0-10.2.4, 10.0.0-10.0.7, 9.4.0-9.4.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Splunk Enterprise is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users.

Executive Summary:
A high-severity Cross-Site Request Forgery vulnerability in Splunk Enterprise allows attackers to execute unauthorized commands, threatening the integrity and confidentiality of the platform.

Vulnerability Details

CVE-ID: CVE-2026-20296

Affected Software: Splunk Enterprise and Splunk Cloud Platform

Affected Versions: See metadata for full list of specific affected ranges.

Vulnerability: The web application fails to sufficiently verify the intent of user requests, leading to a CSRF vulnerability (CWE-352). This allows an attacker to trick an authenticated user into performing actions without their consent.

Business Impact

Successful exploitation could allow an attacker to modify system configurations, access sensitive data, or perform administrative actions. With a CVSS score of 8.3, this represents a major security risk that could lead to full compromise of the Splunk environment.

Remediation Plan

Immediate Action: Update Splunk Enterprise and Splunk Cloud Platform to the versions specified in the vendor advisory (SVD-2026-0702).

Proactive Monitoring: Review audit logs for unexpected configuration changes or administrative actions initiated by standard user accounts.

Compensating Controls: Ensure users are logged out of administrative sessions when not in use and implement strict browser-based security policies to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if a user with an active administrative session visits a malicious site.

Analyst Recommendation

Given the potential for complete system impact, administrators must prioritize the update to the latest versions of Splunk. Failure to patch leaves the environment vulnerable to unauthorized administrative manipulation.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Cisco IOS XE Software stemming from improper input validation may allow an unauthenticated attacker to cause a denial of service.

Executive Summary:
An improper input validation flaw in Cisco IOS XE Software permits unauthenticated remote attackers to cause a denial of service, threatening the availability of critical network infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-20273

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This is an improper input validation vulnerability (CWE-20). It allows an unauthenticated remote attacker to send crafted input that the software fails to sanitize, resulting in a denial of service.

Business Impact

The ability for an unauthenticated attacker to remotely disrupt network hardware represents a severe operational risk. A CVSS score of 8.6 indicates that this vulnerability is highly critical for organizations relying on Cisco IOS XE for core network operations.

Remediation Plan

Immediate Action: Monitor the Cisco security portal for the specific patch version and update the affected software as part of the next maintenance cycle.

Proactive Monitoring: Review device logs for anomalies or unexpected crashes that could suggest attempts to exploit input validation flaws.

Compensating Controls: Deploy WAF or network-level inspection tools to identify and block malicious traffic patterns before they reach the vulnerable Cisco devices.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Input validation issues are common attack vectors, and this vulnerability is considered highly automatable.

Analyst Recommendation

This vulnerability is a significant threat to network reliability. Administrators must prioritize the application of vendor-supplied updates to mitigate the risk of unauthenticated remote attacks against their infrastructure.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco IOS XE Software contains multiple injection vulnerabilities due to improper neutralization of special elements, addressed in recent software hardening releases.

Executive Summary:
Cisco has released critical security updates for IOS XE Software to address multiple injection vulnerabilities that could allow unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2026-20272

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This vulnerability involves the improper neutralization of special elements in output used by downstream components, categorized as CWE-74 (Injection). The flaw allows unauthenticated remote attackers to potentially execute arbitrary commands or manipulate system data depending on the specific injection vector.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to network infrastructure. Successful exploitation could result in full system compromise, loss of confidentiality, integrity, and availability of network services, potentially impacting entire segments of the corporate network.

Remediation Plan

Immediate Action: Apply the recommended Cisco IOS XE software updates immediately as detailed in the official Cisco security advisory.

Proactive Monitoring: Monitor network device logs for unusual traffic patterns, unauthorized configuration changes, or attempts to access restricted management interfaces.

Compensating Controls: Utilize Access Control Lists (ACLs) to restrict access to management interfaces, ensuring only trusted management stations can reach the affected devices.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. These vulnerabilities were identified through internal security reviews, highlighting the importance of timely patching even in the absence of known public exploits.

Analyst Recommendation

The severity of this vulnerability necessitates a rapid deployment of security patches. Network administrators should verify their current software versions against the affected list and schedule maintenance windows to update Cisco IOS XE devices as a matter of urgency.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Cisco IOS XE Software involving insufficient control flow management may allow an unauthenticated attacker to trigger a denial of service.

Executive Summary:
A control flow vulnerability in Cisco IOS XE Software enables unauthenticated remote attackers to disrupt device operations, creating a high risk of network service interruption.

Vulnerability Details

CVE-ID: CVE-2026-20271

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This is an insufficient control flow management vulnerability (CWE-691). The flaw allows an unauthenticated remote attacker to impact system stability by sending malicious traffic to the device.

Business Impact

Exploitation of this vulnerability leads to a denial of service, causing a loss of network connectivity for dependent services and users. With a CVSS score of 8.6, this flaw poses a serious threat to the availability of managed network environments.

Remediation Plan

Immediate Action: Review the official Cisco security advisory to identify the correct remediation path and apply vendor security updates as soon as they are released.

Proactive Monitoring: Monitor system logs for unusual control plane activity or service failure events.

Compensating Controls: Utilize infrastructure firewalls to restrict traffic to critical networking hardware, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of opportunistic exploitation attempts.

Analyst Recommendation

Given the potential for remote, unauthenticated exploitation, organizations should treat this vulnerability with high priority. Ensure that security teams have identified all vulnerable Cisco devices and are prepared to apply patches immediately upon vendor confirmation.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Cisco IOS XE Software involves an incorrect calculation flaw, potentially leading to a denial of service condition.

Executive Summary:
An incorrect calculation vulnerability in Cisco IOS XE Software allows unauthenticated remote attackers to cause a denial of service, posing a high risk to network availability.

Vulnerability Details

CVE-ID: CVE-2026-20270

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This is an incorrect calculation vulnerability (CWE-682). It allows an unauthenticated remote attacker to trigger a system crash or service disruption through specially crafted traffic.

Business Impact

Successful exploitation results in a denial of service, which can render critical network infrastructure unreachable. Given the CVSS score of 8.6, this represents a significant risk to operational continuity, potentially causing substantial business downtime.

Remediation Plan

Immediate Action: Consult the official Cisco security advisory to identify the specific software release that addresses this vulnerability and apply the update immediately.

Proactive Monitoring: Monitor device logs for unexpected reloads or service crashes that may indicate exploitation attempts.

Compensating Controls: Implement access control lists (ACLs) to restrict access to the device management plane from untrusted networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by unauthenticated attackers, making timely patching a priority for network stability.

Analyst Recommendation

This high-severity vulnerability requires immediate attention to prevent potential service outages. Administrators should review the Cisco security advisory referenced in the metadata and apply the necessary patches to all affected IOS XE instances as soon as they become available.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A resource management vulnerability in Cisco IOS XE Software identified during an internal review could allow an unauthenticated remote attacker to cause a denial of service on an affected device.

Executive Summary:
A resource control vulnerability in Cisco IOS XE Software permits an unauthenticated remote attacker to trigger a denial of service on affected hardware.

Vulnerability Details

CVE-ID: CVE-2026-20269

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: The vulnerability relates to CWE-664, which concerns the improper control of a resource through its lifetime. An unauthenticated attacker can exploit this to exhaust system resources or cause the device to enter a denial of service state.

Business Impact

Successful exploitation poses a high risk to business continuity by causing network devices to become unresponsive. The CVSS score of 8.6 underscores the potential for significant impact on network performance and availability, requiring immediate administrative action.

Remediation Plan

Immediate Action: Update the affected Cisco IOS XE software to the latest patched version provided by the vendor.

Proactive Monitoring: Observe device performance metrics and logs for signs of resource exhaustion or abnormal reloads.

Compensating Controls: Use infrastructure-level access controls to ensure that only authorized administrative traffic can interact with the affected services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw was identified during proactive internal security testing by Cisco.

Analyst Recommendation

Promptly apply the recommended security patches to mitigate this risk. Maintaining a rigorous update cycle for networking equipment is essential to protecting against such vulnerabilities and ensuring the reliability of critical business services.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An internal security review identified a memory buffer vulnerability in Cisco IOS XE Software that could allow an unauthenticated remote attacker to cause a denial of service on an affected device.

Executive Summary:
A memory buffer vulnerability in Cisco IOS XE Software allows an unauthenticated remote attacker to cause a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2026-20268

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This issue is classified as CWE-119, involving the improper restriction of operations within the bounds of a memory buffer. An unauthenticated attacker can leverage this weakness to disrupt system stability and cause a denial of service.

Business Impact

Exploitation of this vulnerability leads to device crashes, which can cause severe disruption to network traffic and business operations. With a CVSS score of 8.6, this flaw represents a significant risk to the availability of critical infrastructure components that rely on Cisco IOS XE.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to all affected Cisco IOS XE systems as soon as possible.

Proactive Monitoring: Monitor system logs for memory-related errors or unexpected device reloads that may indicate an exploitation attempt.

Compensating Controls: Implement firewall rules or ACLs to limit exposure of the device management plane to known, trusted source IP addresses.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability was discovered through internal security hardening efforts.

Analyst Recommendation

Organizations should treat this vulnerability as a high priority. Ensure that all affected devices are patched according to the guidance provided in the Cisco security advisory to maintain the integrity and availability of the network.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the BEEP feature of Cisco IOS XE Software allows an unauthenticated remote attacker to trigger a denial of service condition on affected devices.

Executive Summary:
A high-severity denial of service vulnerability in Cisco IOS XE Software allows unauthenticated remote attackers to crash critical network infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-20263

Affected Software: Cisco IOS XE Software

Affected Versions: 17.2.1a, 16.12.1y, 16.12.3s, 16.7.1b, 16.6.2, 16.6.5, 16.12.1w, 16.9.1d

Vulnerability: This vulnerability exists in the Blocks Extensible Exchange Protocol (BEEP) feature (CWE-388). An unauthenticated, remote attacker can send specifically crafted packets to an affected device, causing it to crash and resulting in a denial of service.

Business Impact

A denial of service attack on core network infrastructure can result in significant operational downtime, preventing legitimate traffic from reaching its destination. The CVSS score of 8.6 reflects the ease of exploitation and the significant impact on network availability.

Remediation Plan

Immediate Action: Consult the official Cisco security advisory to identify the recommended software release that includes the necessary security fixes for your specific hardware platform.

Proactive Monitoring: Monitor device logs for unexpected reloads or BEEP-related error messages that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Use access control lists (ACLs) to restrict access to the BEEP feature to trusted management stations only, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to disrupt network connectivity without requiring authentication.

Analyst Recommendation

Given the potential for network-wide disruption, administrators should treat this vulnerability with high urgency. Apply the vendor-provided software updates as soon as they are available to ensure the stability of the network environment.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: Release 20.9.9.1 and earlier, 20.12.7.1 and earlier, 20.15.4.4 and earlier, 20.15.5.2 and earlier, 20.18.3, and 26.1.1.1 and earlier.
---END_METADATA---

Description Summary:
Cisco Catalyst SD-WAN Manager contains an arbitrary file write vulnerability in its web UI, allowing authenticated remote attackers to escalate privileges to root.

Executive Summary:
This critical vulnerability is currently being exploited in the wild and allows an authenticated attacker to achieve full system compromise via arbitrary file writes.

Vulnerability Details

CVE-ID: CVE-2026-20262

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: Cisco Catalyst SD-WAN Manager Release 20.9.9.1 and earlier, 20.12.7.1 and earlier, 20.15.4.4 and earlier, 20.15.5.2 and earlier, 20.18.3, and 26.1.1.1 and earlier.

Vulnerability: This is an arbitrary file write flaw resulting from insufficient input validation during file uploads in the web UI. An authenticated attacker with at least write access can overwrite critical system files to achieve root-level code execution.

Business Impact

With a CVSS score of 9.5, this vulnerability represents a severe risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the SD-WAN Manager, potentially impacting network-wide traffic, data confidentiality, and system integrity. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog underscores the immediate necessity for remediation.

Remediation Plan

Immediate Action: Upgrade to the patched versions: Cisco Catalyst SD-WAN Release 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2.

Proactive Monitoring: Review system logs for the presence of unexpected files, particularly those named "suspicious.war," or requests to unauthorized webpages.

Compensating Controls: Restrict access to the web UI to trusted management networks and implement strict role-based access control (RBAC) to minimize the number of users with write permissions.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 14, 2026, confirmed active exploitation has been observed in the wild. Attackers have been seen uploading malicious files to gain unauthorized access.

Analyst Recommendation

Given that this vulnerability is actively exploited and carries a critical CVSS score, immediate patching is required. Organizations must prioritize upgrading all affected instances, including On-Prem, Cloud-Pro, and FedRAMP installations, to the specified fixed versions to neutralize this threat.

---METADATA---
VENDOR: Splunk
PRODUCT: Enterprise and Cloud Platform
AFFECTED_VERSIONS: Splunk Enterprise < 10.2.4, 10.0.7; Splunk Cloud Platform < 10.4.2604.3, 10.2.2510.14
---END_METADATA---

Description Summary:
Splunk Enterprise and Cloud Platform contain an authentication bypass vulnerability in a PostgreSQL sidecar service, allowing unauthenticated users to create or truncate arbitrary files.

Executive Summary:
An unauthenticated file operation vulnerability in Splunk Enterprise and Cloud Platform could allow attackers to manipulate sensitive files via a vulnerable sidecar service.

Vulnerability Details

CVE-ID: CVE-2026-20253

Affected Software: Splunk Enterprise and Splunk Cloud Platform

Affected Versions: Splunk Enterprise < 10.2.4 and 10.0.7; Splunk Cloud Platform < 10.4.2604.3 and 10.2.2510.14

Vulnerability: The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). It allows any network-reachable, unauthenticated attacker to invoke file creation or truncation operations through a PostgreSQL sidecar service endpoint.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to system integrity and data availability. Attackers could potentially disrupt services by truncating configuration files or gain further access by creating malicious files, leading to significant system downtime or unauthorized data modification.

Remediation Plan

Immediate Action: Update Splunk Enterprise to version 10.4.0, 10.2.4, 10.0.7, or higher, and verify that Splunk Cloud instances are updated to the latest available versions provided by the vendor.

Proactive Monitoring: Review access logs for unusual requests directed at PostgreSQL sidecar service endpoints and monitor for unexpected changes to critical system files.

Compensating Controls: Use network segmentation or a Web Application Firewall (WAF) to restrict access to the vulnerable sidecar service endpoint to authorized internal management IPs only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of authentication on a critical file-handling function makes this a high-priority target for attackers.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for unauthorized file manipulation, immediate patching is required. Organizations should ensure they are running the recommended versions provided in the vendor advisory to mitigate the risk of unauthenticated remote exploitation.

---METADATA---
VENDOR: Splunk
PRODUCT: Splunk Enterprise / Cloud / Secure Gateway
AFFECTED_VERSIONS: See vendor advisory for full list
---END_METADATA---

Description Summary:
A remote code execution vulnerability in Splunk products arises from unsafe deserialization of data, allowing low-privileged users to execute arbitrary code.

Executive Summary:
A critical remote code execution vulnerability in Splunk Enterprise and related products allows low-privileged users to execute arbitrary code via malicious JSON input.

Vulnerability Details

CVE-ID: CVE-2026-20251

Affected Software: Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway

Affected Versions: Splunk Enterprise < 10.2.4, 10.0.7, 9.4.12, 9.3.13; Splunk Cloud Platform < 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, 9.3.2411.132; Splunk Secure Gateway < 3.10.6, 3.9.20, 3.8.67

Vulnerability: The vulnerability is caused by the unsafe deserialization of App Key Value Store data using the 'jsonpickle' Python library. A low-privileged user can leverage this via the Splunk Secure Gateway app to execute arbitrary code.

Business Impact

With a CVSS score of 8.8, this flaw represents a significant risk, enabling remote code execution from a low-privileged context. This could allow an attacker to escalate privileges, access sensitive logs and data, or pivot deeper into the corporate network, directly impacting the confidentiality and integrity of the Splunk installation.

Remediation Plan

Immediate Action: Apply the specific patches provided by Splunk for the affected versions of Splunk Enterprise, Cloud, and Secure Gateway immediately.

Proactive Monitoring: Monitor for suspicious activity involving the jsonpickle library or unusual API calls to the Splunk Secure Gateway app.

Compensating Controls: Restrict access to the Splunk Secure Gateway application and limit the permissions of low-privileged accounts to prevent them from interacting with sensitive app configurations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve remote code execution makes this a high-priority vulnerability. Organizations must audit their Splunk environments and apply the vendor-recommended updates across all affected components without delay.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator, affecting all Cisco SD-WAN deployment types: on-prem, Cloud-Pro, Cloud (Cisco Managed), and for Government (FedRAMP).
---END_METADATA---

Description Summary:
A command injection and privilege escalation vulnerability exists in the CLI of Cisco Catalyst SD-WAN Manager due to insufficient input validation.

Executive Summary:
Cisco Catalyst SD-WAN Manager is vulnerable to a critical command injection flaw that is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-20245

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator, affecting all Cisco SD-WAN deployment types: on-prem, Cloud-Pro, Cloud (Cisco Managed), and for Government (FedRAMP).

Vulnerability: This is a command injection and privilege escalation vulnerability in the CLI of Cisco Catalyst SD-WAN Manager. While exploitation requires an attacker to possess netadmin privileges—which can be obtained through valid credentials or by chaining other vulnerabilities like CVE-2026-20182 or CVE-2026-20127—the flaw allows for unauthorized configuration changes to be pushed to edge devices.

Business Impact

The CVSS score of 9.5 reflects the extreme severity of this vulnerability. Successful exploitation permits attackers to manipulate network configurations, potentially leading to widespread network disruption, man-in-the-middle attacks, or complete compromise of the SD-WAN infrastructure. The active exploitation observed in the wild significantly elevates the urgency of this advisory.

Remediation Plan

Immediate Action: Review the Cisco security advisory (cisco-sa-sdwan-rpa2-v69WY2SW) and apply all recommended mitigations immediately.

Proactive Monitoring: Monitor CLI logs for unauthorized command execution and audit configuration change logs for any unexpected modifications to edge devices.

Compensating Controls: Restrict administrative access to the SD-WAN Manager CLI to only essential personnel and enforce strict multi-factor authentication (MFA) to mitigate the risk of credential-based access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of June 9, 2026, CISA has confirmed this vulnerability is being actively leveraged by attackers. Cisco has observed limited cases where exploitation resulted in configuration changes pushed to edge devices. Immediate action is required to secure affected environments.

Analyst Recommendation

Given the critical severity and confirmed active exploitation, organizations must prioritize the remediation of this vulnerability. Administrators should consult the vendor advisory immediately to implement the necessary mitigations and ensure that administrative access is strictly controlled to prevent the initial compromise required for exploitation.

---METADATA---
VENDOR: PhotoStack
PRODUCT: PhotoStack Gallery
AFFECTED_VERSIONS: All versions up to, and including, 0
---END_METADATA---

Description Summary:
The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter, allowing for unauthorized database access.

Executive Summary:
A high-severity SQL Injection vulnerability in the PhotoStack Gallery plugin could allow attackers to extract sensitive information from the site's database.

Vulnerability Details

CVE-ID: CVE-2026-2024

Affected Software: PhotoStack Gallery

Affected Versions: All versions up to, and including, 0

Vulnerability: The vulnerability exists due to insufficient escaping of the 'postid' parameter in SQL queries. This allows an attacker to append malicious SQL commands to legitimate queries, potentially leading to unauthorized data retrieval.

Business Impact

SQL Injection can lead to the exposure of sensitive data, including user credentials, site configuration, and customer information. In some configurations, it can also be used to modify or delete database records, leading to data loss or site instability. The CVSS score of 7.5 reflects the high risk to data confidentiality.

Remediation Plan

Immediate Action: Update the PhotoStack Gallery plugin to the latest version immediately to ensure all database queries are properly parameterized.

Proactive Monitoring: Monitor database logs for unusual query patterns or errors that may indicate SQL injection attempts.

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection protection rules enabled to detect and block malicious payloads in the 'postid' parameter.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation. SQL injection remains one of the most common and damaging web vulnerabilities.

Analyst Recommendation

Immediate patching is required to protect the site's database. Organizations should also ensure that the database user for the WordPress site has the least privileges necessary to minimize the impact of a potential injection attack.

---METADATA---
VENDOR: Splunk
PRODUCT: Splunk Enterprise, Splunk Cloud Platform
AFFECTED_VERSIONS: Enterprise 10.2 < 10.2.2, 10.0 < 10.0.5; Cloud 10.3.2512 < 10.3.2512.8, 10.2.2510 < 10.2.2510.11, 10.1.2507 < 10.1.2507.21, 10.0.2503 < 10.0.2503.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Splunk Enterprise and Cloud Platform are susceptible to sensitive information disclosure, as sensitive data may be improperly written to log files.

Executive Summary:
Sensitive information disclosure in Splunk Enterprise and Cloud Platform, caused by insecure logging, could expose valuable data to unauthorized parties.

Vulnerability Details

CVE-ID: CVE-2026-20239

Affected Software: Splunk Enterprise and Splunk Cloud Platform

Affected Versions: Various versions (see metadata); primarily Enterprise 10.x and Cloud 10.x branches.

Vulnerability: This is an information disclosure vulnerability (CWE-532) where sensitive information is inadvertently written to log files, potentially providing guidance to an attacker or exposing user credentials.

Business Impact

The exposure of sensitive information in log files can lead to unauthorized access to system internals or user credentials, significantly increasing the risk of a broader security breach. With a CVSS score of 7.5, this issue presents a substantial risk to the confidentiality of data managed within the Splunk environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided in the vendor advisory for Splunk Enterprise and Cloud Platform.

Proactive Monitoring: Review existing log files for the presence of sensitive data and rotate logs if a breach is suspected.

Compensating Controls: Limit access to log file directories and utilize log aggregation tools that support automated redaction or masking of sensitive information.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to how the software handles data during logging operations.

Analyst Recommendation

Administrators should treat this vulnerability with high priority, as log files are often accessible to a wider range of users than the core application. Update your Splunk instances immediately to ensure sensitive data is no longer exposed through system logs.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Workload
AFFECTED_VERSIONS: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An injection vulnerability exists in Cisco Secure Workload due to improper neutralization of special elements in output.

Executive Summary:
Cisco Secure Workload is vulnerable to an injection attack that could allow an authenticated user to achieve full system control.

Vulnerability Details

CVE-ID: CVE-2026-20231

Affected Software: Cisco Secure Workload

Affected Versions: 2.2.1.41, 2.3.1.41, 2.3.1.45, 3.2.1.18, 3.3.2.28, 3.3.2.50, 3.4.1.28, 3.4.1.34

Vulnerability: This vulnerability involves improper neutralization of special elements (CWE-74) in output used by downstream components. An attacker with low-level privileges can inject malicious content, leading to unintended command execution.

Business Impact

The CVSS score of 9.9 underscores the critical nature of this injection flaw. While it requires authenticated access, the ability to achieve total system impact allows a malicious actor to bypass security controls, access sensitive data, or disrupt business operations entirely.

Remediation Plan

Immediate Action: Update Cisco Secure Workload to the latest hardened release provided by the vendor.

Proactive Monitoring: Monitor for anomalous system output and unauthorized changes to system configurations or command execution logs.

Compensating Controls: Enforce strict input validation and least privilege access policies for all authenticated users to limit the potential blast radius of an injection exploit.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed exploitation, though the technical impact remains high.

Analyst Recommendation

Security teams must prioritize the deployment of the latest updates to address this injection vulnerability. Ensuring that all authenticated user activity is monitored and restricted is essential to maintaining system security until the patch is applied.