---METADATA---
VENDOR: Cisco
PRODUCT: Unified Communications Manager (Unified CM)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to perform arbitrary file operations and escalate privileges to root.

Executive Summary:
A critical SSRF vulnerability in Cisco Unified Communications Manager allows an unauthenticated, remote attacker to execute arbitrary file operations and potentially gain root-level system access.

Vulnerability Details

CVE-ID: CVE-2026-20230

Affected Software: Cisco Unified Communications Manager (Unified CM) and Session Management Edition (SME)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a server-side request forgery (SSRF) flaw that does not require authentication. It allows remote attackers to force the application to perform unauthorized requests, leading to arbitrary file operations on the underlying OS and potential privilege escalation to root.

Business Impact

The CVSS score of 8.6 indicates a severe risk to internal infrastructure. Because this vulnerability allows an unauthenticated attacker to manipulate file operations and gain root access, the potential impact includes total compromise of the communications server, unauthorized access to sensitive call data, and potential lateral movement into the core network.

Remediation Plan

Immediate Action: Consult the official Cisco security advisory and apply the necessary patches or software upgrades immediately.

Proactive Monitoring: Inspect network traffic to and from the Unified CM server for anomalous requests or unauthorized outbound connections that suggest SSRF activity.

Compensating Controls: Restrict network access to the management interface of the Unified CM to trusted internal segments only, and utilize a WAF to block malformed or suspicious HTTP requests.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for an unauthenticated attacker to gain root access, this vulnerability must be treated with the highest urgency. IT administrators should verify the version of their Cisco Unified CM deployment and apply relevant security updates as soon as they are made available by the vendor.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager allows unauthenticated remote attackers to read arbitrary files via improper input validation.

Executive Summary:
A critical file read vulnerability in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to access sensitive system files, posing a significant data exposure risk.

Vulnerability Details

CVE-ID: CVE-2026-20224

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2

Vulnerability: This is an Improper Input Validation vulnerability (CWE-20) that manifests in the web UI. It allows an unauthenticated remote attacker to perform arbitrary file reads, facilitating the disclosure of sensitive configuration data or system credentials.

Business Impact

With a CVSS score of 8.6, this vulnerability is highly critical due to the unauthenticated nature of the attack. Unauthorized access to system files can lead to the exposure of cryptographic keys, configuration files, and other sensitive information, potentially enabling full system compromise.

Remediation Plan

Immediate Action: Apply the security updates provided in the Cisco security advisory immediately to remediate the vulnerable web UI components.

Proactive Monitoring: Monitor web server logs for requests containing directory traversal sequences or attempts to access known system configuration file paths.

Compensating Controls: If immediate patching is not possible, place the management interface behind a robust firewall or VPN and restrict access to authorized management subnets only.

Exploitation Status

Public Exploit Available: Yes (GitHub PoC repository exists).

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation in the wild; however, a public proof-of-concept exists on GitHub, which significantly lowers the barrier to entry for attackers. The vulnerability's inherent design, allowing for unauthenticated file access, makes it highly attractive to adversaries.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability makes it a high-priority risk. Organizations must treat this as an emergency patching requirement and ensure all affected Catalyst SD-WAN Manager instances are updated without delay.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Workload
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Cisco Secure Workload contains an access validation flaw in internal REST APIs that permits unauthenticated, remote attackers to perform unauthorized configuration changes as a Site Admin.

Executive Summary:
An unauthenticated remote code execution vulnerability in Cisco Secure Workload allows attackers to bypass authentication and gain full administrative control over site resources.

Vulnerability Details

CVE-ID: CVE-2026-20223

Affected Software: Cisco Secure Workload

Affected Versions: See vendor advisory

Vulnerability: This is an authentication bypass vulnerability affecting internal REST API endpoints. Unauthenticated attackers can send specifically crafted requests to these endpoints, successfully masquerading as a Site Admin user.

Business Impact

A successful exploitation grants an attacker full administrative privileges, leading to unauthorized data exfiltration, modification of network security policies, and complete compromise of the Secure Workload environment. Given the critical CVSS score of 10.0, this vulnerability presents an immediate, catastrophic risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Cisco immediately.

Proactive Monitoring: Audit REST API access logs for anomalous, high-privilege requests originating from unauthorized or external IP addresses.

Compensating Controls: Implement strict network segmentation and restrict access to the Secure Workload management interfaces to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate remediation. Administrators must prioritize applying vendor-supplied updates to all affected Secure Workload instances to close the authentication bypass vector and prevent unauthorized administrative access.

---METADATA---
VENDOR: Cisco
PRODUCT: Unified Computing System (Standalone)
AFFECTED_VERSIONS: 4.3(1.230097), 4.3(1.230124), 4.3(1.230138), 4.3(2.230207), 4.3(2.230270), 4.3(2.240002), 4.3(3.240022), 4.3(3.240043)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in the Cisco IMC management interface allows authenticated, low-privilege users to execute arbitrary commands and escalate to root privileges.

Executive Summary:
A critical command injection vulnerability in the Cisco Unified Computing System management interface allows authenticated attackers to achieve full root-level system compromise.

Vulnerability Details

CVE-ID: CVE-2026-20200

Affected Software: Cisco Unified Computing System (Standalone)

Affected Versions: 4.3(1.230097), 4.3(1.230124), 4.3(1.230138), 4.3(2.230207), 4.3(2.230270), 4.3(2.240002), 4.3(3.240022), 4.3(3.240043)

Vulnerability: This vulnerability, categorized as CWE-141, exists due to improper neutralization of parameter delimiters within the web-based management interface. It requires an authenticated attacker with low privileges to trigger the flaw, resulting in arbitrary operating system command execution.

Business Impact

Successful exploitation grants an attacker administrative control over the affected system. Given the CVSS score of 8.8, this poses a severe risk of data exfiltration, service disruption, and the potential for lateral movement within the network. The ability to escalate to root privileges makes this a high-priority concern for infrastructure security.

Remediation Plan

Immediate Action: Apply the vendor-supplied security updates referenced in the Cisco security advisory at the earliest opportunity.

Proactive Monitoring: Monitor system access logs for anomalous command execution patterns or unauthorized attempts to access high-privilege shell functions.

Compensating Controls: Restrict access to the management interface to trusted administrative IP addresses using Access Control Lists (ACLs) to minimize the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of August 6, 2026, there is no confirmed active exploitation in the wild. However, a public proof-of-concept is available, which significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

This vulnerability presents a clear path to total system compromise for authenticated users. Organizations should prioritize patching affected Cisco IMC instances immediately to prevent potential exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Identity Services Engine (ISE)
AFFECTED_VERSIONS: 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in Cisco Identity Services Engine (ISE) allows an authenticated remote attacker with Read-Only Admin credentials to execute arbitrary commands as root.

Executive Summary:
A critical command injection vulnerability in Cisco ISE allows an authenticated attacker to achieve full root-level compromise and potentially trigger a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2026-20186

Affected Software: Cisco Identity Services Engine (ISE)

Affected Versions: 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1

Vulnerability: This is a command injection vulnerability (CWE-77) caused by insufficient input validation of HTTP requests. An attacker possessing Read-Only Admin credentials can exploit this to execute arbitrary commands on the underlying operating system, eventually escalating privileges to root.

Business Impact

With a CVSS score of 9.9, this vulnerability is extremely severe. An attacker who has gained low-level administrative access can pivot to full system control, potentially compromising the entire network identity and access management infrastructure. Furthermore, the risk of a DoS condition could lead to widespread network authentication failures across the organization.

Remediation Plan

Immediate Action: Update Cisco Identity Services Engine to the latest patched version specified in the vendor security advisory (cisco-sa-ise-rce-4fverepv).

Proactive Monitoring: Review access logs for suspicious HTTP requests targeting ISE administrative interfaces and monitor system integrity for unauthorized process execution.

Compensating Controls: Restrict administrative access to the ISE management interface to a limited set of known-good IP addresses and enforce multi-factor authentication for all administrative accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for Read-Only Admin credentials slightly limits the initial attack surface, but the potential for total system takeover makes this a high-priority item.

Analyst Recommendation

Due to the high CVSS score and the critical role of Cisco ISE in network security, this update should be applied during the next maintenance window. Ensure that all administrative access is audited and restricted to authorized personnel to prevent initial exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Webex Services
AFFECTED_VERSIONS: 39.7.7, 39.9, 40.4.10, 39.6, 40.6.2, 39.8.2, 39.8.4, 40.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in Cisco Webex Services' SSO integration allows unauthenticated remote attackers to impersonate users via improper certificate validation.

Executive Summary:
A critical authentication bypass flaw in Cisco Webex Services could allow unauthenticated, remote attackers to impersonate any user within the service.

Vulnerability Details

CVE-ID: CVE-2026-20184

Affected Software: Cisco Webex Services

Affected Versions: 39.7.7, 39.9, 40.4.10, 39.6, 40.6.2, 39.8.2, 39.8.4, 40.1

Vulnerability: The vulnerability stems from improper certificate validation within the single sign-on (SSO) integration, allowing an unauthenticated remote attacker to gain unauthorized access by submitting a crafted token.

Business Impact

Successful exploitation results in full account impersonation, potentially granting attackers access to sensitive internal communications, shared files, and meeting data. Given the CVSS score of 9.8, this vulnerability poses a severe risk of data breach and unauthorized system access, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update Cisco Webex Services to the latest available version provided by the vendor.

Proactive Monitoring: Audit Webex access logs for unusual login patterns, unexpected token usage, or authentication anomalies originating from unauthorized IP ranges.

Compensating Controls: Ensure that strict network egress/ingress filtering is in place and monitor for unauthorized SSO traffic patterns; implement multi-factor authentication (MFA) where possible to add a layer of defense against token-based impersonation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of 2026-04-15, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its remote, unauthenticated nature and the potential for total compromise of user identity.

Analyst Recommendation

This is a critical-severity vulnerability that permits unauthenticated access to Cisco Webex environments. Organizations should prioritize patching all affected Webex instances immediately to prevent potential user impersonation and unauthorized data access.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the control connection handshaking of Cisco Catalyst SD-WAN allows unauthenticated, remote attackers to bypass authentication and obtain administrative access.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN control connections is being actively exploited in the wild, posing an immediate threat to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-20182

Affected Software: Cisco Catalyst SD-WAN

Affected Versions: See vendor advisory

Vulnerability: This flaw exists within the control connection handshaking process, enabling an unauthenticated attacker to bypass authentication. Exploitation allows the attacker to log in as a high-privileged user and manipulate the SD-WAN fabric via NETCONF.

Business Impact

Assigned a CVSS score of 10.0, this vulnerability permits full administrative control over the SD-WAN fabric. Successful exploitation could result in complete compromise of network traffic, unauthorized data exfiltration, and significant disruption to enterprise-wide network operations.

Remediation Plan

Immediate Action: Update all Cisco Catalyst SD-WAN components to the latest version provided by the vendor to address the control connection handshake flaw.

Proactive Monitoring: Utilize the vendor-provided "Show Control Connections" guidance to verify system integrity and identify anomalous connection attempts.

Compensating Controls: Deploy strict firewall rules to limit management plane access and monitor for unauthorized administrative sessions.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 14, 2026, this vulnerability is confirmed to be under active exploitation in the wild. This issue serves as a critical follow-up to previous SD-WAN vulnerabilities and requires immediate attention to prevent unauthorized fabric manipulation.

Analyst Recommendation

Organizations must treat this as a high-priority incident. Beyond applying the necessary updates, security teams should conduct a thorough audit of all control plane connections and review logs for signs of compromise to ensure the environment has not been subverted by attackers.

---METADATA---
VENDOR: Cisco
PRODUCT: Identity Services Engine (ISE)
AFFECTED_VERSIONS: 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authenticated remote attacker can execute arbitrary commands on Cisco Identity Services Engine by sending crafted HTTP requests, potentially leading to root-level access and denial of service.

Executive Summary:
A critical command injection vulnerability in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to achieve remote code execution as root.

Vulnerability Details

CVE-ID: CVE-2026-20180

Affected Software: Cisco Identity Services Engine (ISE)

Affected Versions: 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1

Vulnerability: The vulnerability is caused by insufficient input validation (CWE-22), allowing an attacker with at least Read Only Admin credentials to send crafted HTTP requests that result in arbitrary command execution on the underlying OS.

Business Impact

An attacker gaining root access to the Cisco ISE device can compromise the entire network authentication infrastructure, leading to total loss of confidentiality, integrity, and availability. With a CVSS score of 9.9, this vulnerability represents an existential risk to the security of the network perimeter and internal access controls.

Remediation Plan

Immediate Action: Update Cisco Identity Services Engine (ISE) to the latest patched version specified in the vendor security advisory.

Proactive Monitoring: Review administrative audit logs for suspicious HTTP requests or unexpected command execution attempts on the ISE appliance.

Compensating Controls: Restrict administrative access to the ISE management interface to trusted internal IP addresses only, and implement strict least-privilege policies to minimize the number of users with Read Only Admin or higher roles.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of 2026-04-15, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While authenticated access is required, the ability to escalate to root makes this a high-priority threat.

Analyst Recommendation

Given the potential for complete system takeover and denial of service, administrators must treat this vulnerability with the highest urgency. Patching should be conducted immediately, and administrative access to the ISE console should be strictly limited until updates are applied.

---METADATA---
VENDOR: IP-COM
PRODUCT: W30AP
AFFECTED_VERSIONS: Up to 1.0.0.11(1340)
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the IP-COM W30AP access point via the R7WebsSecurityHandler function. Remote attackers can exploit the "data" argument in a POST request to execute code.

Executive Summary:
A critical, publicly exploitable buffer overflow vulnerability in IP-COM W30AP access points allows remote attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-2017

Affected Software: IP-COM W30AP

Affected Versions: Up to 1.0.0.11(1340)

Vulnerability: The R7WebsSecurityHandler function in the /goform/wx3auth component fails to properly validate the length of the "data" argument in POST requests. This leads to a stack-based buffer overflow that can be triggered remotely by an unauthenticated attacker.

Business Impact

With a CVSS score of 9.8 and a public exploit available, the risk of device compromise is extreme. Attackers can gain persistent access to the network infrastructure, intercept traffic, or use the compromised access point as a pivot point for further attacks.

Remediation Plan

Immediate Action: Due to the lack of vendor response, administrators should consider replacing affected devices or placing them behind a strict firewall that blocks access to the /goform/ interface.

Proactive Monitoring: Monitor network traffic for anomalous POST requests to the /goform/wx3auth endpoint and check for unexpected reboots or configuration changes on the access points.

Compensating Controls: Disable the web management interface on the WAN side and restrict LAN-side access to trusted administrative workstations only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Feb 6, 2026, a public exploit exists for this vulnerability. The vendor has not responded to disclosure attempts, significantly increasing the risk for organizations still using this hardware.

Analyst Recommendation

Because an exploit is public and the vendor is unresponsive, this vulnerability poses an immediate threat. We strongly recommend decommissioning affected IP-COM W30AP units or implementing stringent network isolation to prevent exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Smart Software Manager On-Prem (SSM On-Prem)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The exposure of an internal service in Cisco SSM On-Prem allows unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted API requests.

Executive Summary:
Cisco Smart Software Manager On-Prem is vulnerable to unauthenticated remote code execution with root privileges due to the unintentional exposure of an internal service API.

Vulnerability Details

CVE-ID: CVE-2026-20160

Affected Software: Cisco Smart Software Manager On-Prem (SSM On-Prem)

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: This flaw is caused by the exposure of an internal service's API. An unauthenticated remote attacker can send crafted requests to this API to execute arbitrary commands on the host operating system with root-level privileges.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this RCE vulnerability. Root-level access allows an attacker to completely take over the SSM On-Prem host, steal licensing data, and use the system as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Update Cisco SSM On-Prem to the latest available version to close the exposed service and secure the API.

Proactive Monitoring: Review system logs for unauthorized command execution and inspect network traffic for unusual API calls directed at internal-only service ports.

Compensating Controls: Implement strict firewall rules to ensure that only authorized administrative IPs can access the SSM On-Prem management and API ports.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. Remote code execution with root privileges is a critical threat that requires immediate remediation.

Analyst Recommendation

Applying the Cisco-provided patch is essential to prevent total system compromise. Organizations should also audit their network architecture to ensure that internal services are not reachable from outside the intended management segment.

---METADATA---
VENDOR: Cisco
PRODUCT: RoomOS Software
AFFECTED_VERSIONS: RoomOS 10.11.2.2, 10.15.2.2, 11.5.4.6, 11.5.2.4, 10.8.2.5, 10.11.5.2, 10.11.3.0, 10.15.5.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Cisco RoomOS Software contains an improper access control vulnerability that could allow an authenticated remote attacker to perform unauthorized actions.

Executive Summary:
An improper access control flaw in Cisco RoomOS software, identified during an internal review, poses a high risk of unauthorized system interaction for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-20150

Affected Software: Cisco RoomOS Software

Affected Versions: RoomOS 10.11.2.2, 10.15.2.2, 11.5.4.6, 11.5.2.4, 10.8.2.5, 10.11.5.2, 10.11.3.0, 10.15.5.3

Vulnerability: This vulnerability is a result of improper access control (CWE-284). It allows an authenticated attacker to perform unauthorized operations, as the system fails to correctly validate the permissions of the authenticated user during certain requests.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to the security of Cisco collaboration endpoints. Unauthorized access could allow an attacker to disrupt communications, gain access to sensitive configuration data, or manipulate device settings, leading to potential operational downtime or loss of confidentiality.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to the affected RoomOS versions as outlined in the official Cisco security advisory.

Proactive Monitoring: Review device access logs and system audit trails for anomalous command execution or attempts to access restricted management interfaces.

Compensating Controls: Restrict access to the management interfaces of Cisco devices to trusted administrative networks only, utilizing firewall rules to minimize exposure.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw was identified through an internal security review, indicating proactive discovery by the vendor.

Analyst Recommendation

Organizations should treat this high-severity vulnerability with urgency. Deploying the provided firmware updates is the primary method for remediation and should be coordinated through standard patch management cycles to ensure all affected endpoint devices are secured against potential unauthorized access.

---METADATA---
VENDOR: Cisco
PRODUCT: ISE and ISE Passive Identity Connector
AFFECTED_VERSIONS: 3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1, 3.3.0, 3.4.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A command injection vulnerability in Cisco ISE and ISE-PIC allows authenticated administrative users to execute arbitrary commands on the underlying OS, risking root-level compromise and DoS.

Executive Summary:
A critical command injection vulnerability in Cisco ISE and ISE-PIC allows authenticated administrative attackers to execute arbitrary system commands and potentially gain root privileges.

Vulnerability Details

CVE-ID: CVE-2026-20147

Affected Software: Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC)

Affected Versions: Cisco ISE (3.1.0, 3.1.0 p1, 3.1.0 p3, 3.1.0 p2, 3.2.0, 3.1.0 p4, 3.1.0 p5, 3.2.0 p1), ISE-PIC (3.2.0, 3.1.0, 3.3.0, 3.4.0)

Vulnerability: This vulnerability (CWE-77) results from insufficient validation of user-supplied input, allowing an authenticated attacker with administrative credentials to execute arbitrary commands, escalate to root, or trigger a denial-of-service condition.

Business Impact

Exploitation of this vulnerability allows an attacker to gain full control over identity services, which are central to network security. The potential for total system compromise and the interruption of critical network authentication services justifies the 9.9 CVSS severity rating.

Remediation Plan

Immediate Action: Update both Cisco ISE and Cisco ISE Passive Identity Connector to the latest versions recommended by the vendor.

Proactive Monitoring: Monitor administrative login activity and inspect system logs for unusual command execution patterns or abnormal process behavior on ISE nodes.

Compensating Controls: Enforce strict access control lists (ACLs) for the management interface and ensure that administrative credentials are managed securely to prevent potential abuse by malicious insiders or compromised accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of 2026-04-15, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Although it requires administrative credentials, the high technical impact makes this a significant risk.

Analyst Recommendation

Security teams must prioritize patching these systems as they are fundamental to network authentication. Ensure that all affected nodes, including Passive Identity Connector instances, are updated immediately to mitigate the risk of command injection and root-level exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Management Center (FMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical insecure deserialization flaw in the Cisco FMC web interface allows unauthenticated remote attackers to execute arbitrary Java code with root privileges via crafted serial objects.

Executive Summary:
An unauthenticated remote attacker can gain full root-level control over the Cisco Secure Firewall Management Center by exploiting an insecure Java deserialization vulnerability.

Vulnerability Details

CVE-ID: CVE-2026-20131

Affected Software: Cisco Secure Firewall Management Center (FMC)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability exists in the web-based management interface due to the insecure deserialization of user-supplied Java byte streams. An unauthenticated remote attacker can trigger this flaw by sending a crafted serialized Java object, leading to arbitrary code execution as the root user.

Business Impact

Successful exploitation results in a total compromise of the management platform, allowing attackers to manipulate firewall policies, intercept traffic, or pivot into the internal network. With a CVSS score of 10.0, this represents the highest possible risk to organizational security and infrastructure integrity. The ability for an unauthenticated actor to achieve root access necessitates immediate intervention to prevent catastrophic data loss or system downtime.

Remediation Plan

Immediate Action: Update Cisco Secure Firewall Management Center to the latest patched version immediately as specified in the Cisco Security Advisory.

Proactive Monitoring: Monitor network traffic for unusual POST requests to the FMC web interface and audit system logs for unauthorized "root" account activity or unexpected Java process executions.

Compensating Controls: Restrict access to the FMC management interface to trusted internal networks only and deploy a Web Application Firewall (WAF) to filter serialized Java objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical role of FMC in network security, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated; a CVSS 10.0 rating indicates a critical risk to the entire network perimeter. Organizations must prioritize the application of the vendor-supplied patch immediately. Until patching is complete, ensure the management interface is not exposed to the public internet to reduce the attack surface.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A peering authentication flaw in Cisco Catalyst SD-WAN controllers allows unauthenticated, remote attackers to bypass authentication and gain administrative privileges.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN has been identified and is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-20127

Affected Software: Cisco Catalyst SD-WAN

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a failure in the peering authentication mechanism, allowing an unauthenticated remote attacker to send crafted requests to the system. Successful exploitation grants the attacker administrative access to the SD-WAN fabric via NETCONF.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk to organizational infrastructure. An attacker gaining administrative control over the SD-WAN fabric can manipulate network traffic, intercept sensitive data, or disrupt critical business communications, leading to severe reputational damage and operational downtime.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Cisco immediately to resolve the authentication bypass.

Proactive Monitoring: Review system and network access logs for unusual NETCONF activity or unauthorized administrative logins.

Compensating Controls: Implement strict network segmentation and restrict access to the SD-WAN control plane to trusted management IP addresses only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Feb 25, 2026, this vulnerability is confirmed to be under active exploitation in the wild. Given the critical nature of the flaw and the evidence of exploitation, immediate patching is mandatory for all affected Cisco Catalyst SD-WAN deployments.

Analyst Recommendation

The extreme severity of this vulnerability, combined with confirmed active exploitation, necessitates an immediate emergency response. Organizations should prioritize patching all Cisco Catalyst SD-WAN controllers and perform a thorough forensic review of their network configurations to ensure no unauthorized changes have been introduced.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager allows an authenticated, local attacker with low-level privileges to gain root access to the underlying operating system.

Executive Summary:
Cisco Catalyst SD-WAN Manager is vulnerable to a local privilege escalation flaw that allows authenticated users with minimal permissions to gain full root-level control over the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-20126

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists within the underlying operating system management component of the SD-WAN Manager. It allows a local, authenticated attacker with low-level access to bypass security restrictions and elevate their privileges to root (superuser).

Business Impact

A successful exploit grants the attacker total control over the SD-WAN Manager, which is a central orchestration point for network infrastructure. This could lead to the interception of sensitive network traffic, unauthorized configuration changes, and complete compromise of the SD-WAN fabric. The CVSS score of 8.8 reflects the high severity of allowing a low-privileged user to achieve administrative dominance over a critical networking asset.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to all affected Catalyst SD-WAN Manager instances.

Proactive Monitoring: Audit local user accounts for unauthorized privilege changes and review system logs for unusual commands executed with root permissions.

Compensating Controls: Restrict local access to the SD-WAN Manager interface to only essential personnel using the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its impact on core network infrastructure, the potential for exploitation is high once a proof-of-concept is developed.

Analyst Recommendation

This vulnerability represents a significant risk to organizational network integrity. Administrators must prioritize the deployment of vendor-supplied patches to prevent internal actors or compromised accounts from seizing control of the SD-WAN environment. Immediate remediation is the only effective way to mitigate this high-severity risk.

---METADATA---
VENDOR: Cisco
PRODUCT: TelePresence Collaboration Endpoint (CE) / RoomOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the text rendering subsystem of Cisco TelePresence CE and RoomOS allows unauthenticated remote attackers to cause a denial of service (DoS) condition.

Executive Summary:
Unauthenticated remote attackers can trigger a denial of service on Cisco TelePresence and RoomOS devices by exploiting a vulnerability in the text rendering subsystem.

Vulnerability Details

CVE-ID: CVE-2026-20119

Affected Software: Cisco TelePresence CE Software and RoomOS Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw exists within the text rendering subsystem of the device software. An unauthenticated, remote attacker can exploit this by sending malicious input that the system fails to process correctly, resulting in a device crash or reboot.

Business Impact

Exploitation of this vulnerability directly impacts the availability of collaboration services, leading to system downtime during critical meetings. While the CVSS score is 7.5, the High severity reflects the potential for repeated disruption of business-critical video conferencing hardware across the enterprise.

Remediation Plan

Immediate Action: Update affected Cisco TelePresence and RoomOS devices to the latest patched versions as specified in the Cisco security advisory.

Proactive Monitoring: Monitor network traffic for unusual packets targeting collaboration endpoints and track device uptime for unexpected reboots.

Compensating Controls: Implement network-level access control lists (ACLs) to ensure only authorized traffic can reach the management and signaling interfaces of the devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Denial of Service vulnerabilities are often utilized to mask other malicious activities or cause widespread operational friction.

Analyst Recommendation

To maintain the availability of organizational communication channels, it is essential to apply the vendor's updates. Prioritize patching devices that are exposed to broader internal networks or the public internet.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authenticated remote attacker with valid VPN credentials can exhaust device memory on Cisco ASA and FTD systems, leading to a Denial of Service for new SSL VPN connections.

Executive Summary:
A vulnerability in Cisco Secure Firewalls allows authenticated VPN users to trigger memory exhaustion, effectively blocking all subsequent remote access attempts to the network.

Vulnerability Details

CVE-ID: CVE-2026-20105

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Remote Access SSL VPN functionality. An authenticated, remote attacker with a valid VPN connection can perform actions that lead to the exhaustion of device memory, resulting in a Denial of Service (DoS) for all new incoming VPN connections.

Business Impact

The CVSS score of 7.7 indicates a High-severity risk to availability. By exhausting system memory, an attacker can prevent legitimate employees from establishing new secure connections, paralyzing remote operations. This type of attack is particularly damaging as it may persist until the device is manually cleared or rebooted, impacting productivity and incident response.

Remediation Plan

Immediate Action: Deploy the recommended security updates from Cisco to all affected ASA and FTD appliances immediately.

Proactive Monitoring: Implement granular monitoring of memory pools on firewall devices and configure SNMP traps to alert administrators when memory utilization exceeds 80%.

Compensating Controls: Use strict egress filtering and session limits per user to mitigate the speed and scale at which an authenticated attacker can consume system resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. Although authentication is required, internal threats or compromised endpoints could easily leverage this flaw to disrupt operations.

Analyst Recommendation

Immediate patching is recommended to maintain the integrity of remote access services. Administrators should prioritize these updates to ensure that a single compromised account cannot be used to deny service to the entire organization. Regular audits of VPN user accounts and permissions are also advised.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated, remote vulnerability in Cisco ASA and FTD Software allows attackers to exhaust device memory via SSL VPN functionality, leading to a persistent Denial of Service (DoS) condition.

Executive Summary:
Cisco Secure Firewall devices are vulnerable to an unauthenticated remote memory exhaustion attack that can result in a complete Denial of Service for all new SSL VPN connections.

Vulnerability Details

CVE-ID: CVE-2026-20103

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists in the Remote Access SSL VPN functionality where an unauthenticated, remote attacker can send crafted traffic to trigger memory exhaustion. Successful exploitation prevents the device from accepting new VPN connections, effectively halting remote access capabilities.

Business Impact

A successful exploit poses a significant threat to business continuity by disabling remote access for the entire workforce. With a CVSS score of 8.6, this High-severity vulnerability could lead to significant operational downtime and prevent employees from accessing critical internal resources. The lack of authentication requirements increases the likelihood of opportunistic attacks.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to patch the affected ASA and FTD software versions.

Proactive Monitoring: Monitor device memory utilization metrics and set alerts for sudden, unexplained spikes that could indicate an ongoing exhaustion attack.

Compensating Controls: Implement infrastructure access control lists (ACLs) to limit SSL VPN access to known IP ranges if feasible, reducing the exposed attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the unauthenticated nature of the flaw and the critical role of VPN gateways, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of authentication required for exploitation, necessitates immediate remediation. Security teams should prioritize patching all internet-facing Cisco Secure Firewall appliances. Failure to act could result in a total loss of remote connectivity for the organization.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authenticated vulnerability in the LUA interpreter of Cisco ASA and FTD SSL VPN features allows remote attackers with valid credentials to cause an unexpected device reload and Denial of Service.

Executive Summary:
Authenticated users with valid VPN access can trigger a remote device reload on Cisco Secure Firewalls, causing an immediate and disruptive Denial of Service condition.

Vulnerability Details

CVE-ID: CVE-2026-20100

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the LUA interpreter used within the Remote Access SSL VPN feature. An authenticated, remote attacker with a valid VPN connection can execute specific commands that cause the device to crash and reload unexpectedly.

Business Impact

While this exploit requires authentication, it allows any user with valid VPN credentials—including compromised accounts—to take the entire firewall offline. The CVSS score of 7.7 reflects a High-severity risk where system availability is compromised, leading to immediate disconnection of all active sessions and potential data loss during the reboot cycle.

Remediation Plan

Immediate Action: Apply the latest software patches from Cisco to resolve the LUA interpreter flaw in the ASA and FTD platforms.

Proactive Monitoring: Review VPN session logs for unusual activity and monitor system uptime logs for unexpected reboots or "last reload" reasons related to software forced crashes.

Compensating Controls: Enforce multi-factor authentication (MFA) for all VPN users to reduce the risk of an attacker using compromised credentials to trigger this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for a valid VPN connection provides some mitigation, but the impact of a device reload remains critical for availability.

Analyst Recommendation

Organizations should treat this as a high-priority update, especially if they have a large number of VPN users. Patching the LUA interpreter is the only definitive way to prevent authenticated users from disrupting network services. Ensure that all security appliances are updated during the next available maintenance window.

---METADATA---
VENDOR: Cisco
PRODUCT: Meeting Management
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Certificate Management feature of Cisco Meeting Management allows authenticated attackers to upload files and execute commands with root privileges.

Executive Summary:
Cisco Meeting Management is vulnerable to an authenticated remote attack that enables arbitrary file uploads and command execution with full root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-20098

Affected Software: Cisco Meeting Management

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the Certificate Management component. An authenticated, remote attacker with sufficient privileges can exploit this flaw to upload unauthorized files, leading to arbitrary command execution and an elevation of privileges to the root level.

Business Impact

The impact of this vulnerability is severe, as it grants an attacker total control over the Cisco Meeting Management system. With a CVSS score of 8.8, a successful exploit could result in a complete compromise of the underlying operating system, data theft, and the disruption of critical communication services.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to address the flaws in the Certificate Management feature.

Proactive Monitoring: Review system logs for unauthorized certificate uploads or unexpected administrative commands executed within the management interface.

Compensating Controls: Restrict access to the Cisco Meeting Management interface to trusted internal networks and utilize Multi-Factor Authentication (MFA) to mitigate account compromise risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to achieve root access makes this a high-priority target for internal or compromised-account threats.

Analyst Recommendation

Administrators must treat this as a critical update due to the privilege escalation path to root. Immediate patching is recommended to protect the integrity of the meeting infrastructure and prevent lateral movement from the management server.

---METADATA---
VENDOR: Cisco
PRODUCT: Integrated Management Controller (IMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An authentication bypass in Cisco IMC's password change functionality allows unauthenticated remote attackers to reset any user's password and gain administrative access.

Executive Summary:
Cisco Integrated Management Controllers (IMC) are subject to a critical authentication bypass that allows remote attackers to seize administrative control by improperly handling password change requests.

Vulnerability Details

CVE-ID: CVE-2026-20093

Affected Software: Cisco Integrated Management Controller (IMC)

Affected Versions: See vendor advisory for specific affected firmware versions.

Vulnerability: The vulnerability stems from incorrect handling of HTTP password change requests. An unauthenticated, remote attacker can send a crafted request to bypass security checks and reset the password of any user, including the Admin account.

Business Impact

With a CVSS score of 9.8, the impact is severe. An attacker gaining Admin access to the IMC can control the underlying physical server, modify firmware, access data, and potentially brick the hardware, leading to catastrophic operational failure.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Cisco for the Integrated Management Controller to patch the password handling logic.

Proactive Monitoring: Monitor web management logs for successful password changes that were not initiated by authorized personnel and check for anomalous HTTP requests.

Compensating Controls: Disable public internet access to the IMC management interface and restrict access to a dedicated, isolated management VLAN with strict ACLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. The ability to gain Admin rights remotely without credentials makes this a high-priority fix.

Analyst Recommendation

Organizations must treat this as a top-priority security event. Ensure that all Cisco IMC instances are updated immediately and that management interfaces are never exposed to untrusted networks.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Wireless Controller Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in CAPWAP packet processing in Cisco IOS XE Wireless Controller Software allows unauthenticated remote attackers to cause a Denial of Service.

Executive Summary:
Unauthenticated remote attackers can trigger a Denial of Service condition on Cisco Catalyst CW9800 devices by exploiting a flaw in the processing of CAPWAP packets.

Vulnerability Details

CVE-ID: CVE-2026-20086

Affected Software: Cisco IOS XE Wireless Controller Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists in the way the software processes Control and Provisioning of Wireless Access Points (CAPWAP) packets. An unauthenticated, remote attacker can send specially crafted CAPWAP packets to an affected device, causing it to crash or reload, resulting in a Denial of Service (DoS) condition.

Business Impact

This vulnerability carries a CVSS score of 8.6, placing it in the High-severity category. A successful exploit directly impacts business continuity by disabling wireless network connectivity for the entire coverage area of the affected controller. This can lead to significant operational downtime, loss of productivity, and disruption of critical wireless services.

Remediation Plan

Immediate Action: Administrators should apply the latest Cisco IOS XE software updates for the Catalyst CW9800 family to patch the CAPWAP processing logic.

Proactive Monitoring: Enable logging for CAPWAP traffic and monitor for high rates of malformed packets or unexpected controller reboots, which may indicate an ongoing DoS attack.

Compensating Controls: Utilize infrastructure access control lists (iACLs) to permit CAPWAP traffic only from trusted Access Point IP addresses, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation of this vulnerability. Because the attack is unauthenticated and remote, it is a highly attractive target for disruption-focused threat actors.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and its direct impact on network availability, this patch should be treated as a critical priority. Organizations utilizing Cisco Catalyst CW9800 series controllers must update their IOS XE firmware immediately to maintain service availability.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A flaw in the DHCP snooping feature of Cisco IOS XE allows unauthenticated attackers to cause BOOTP packets to be forwarded between VLANs. This leads to a Denial of Service (DoS) condition.

Executive Summary:
Cisco IOS XE Software is vulnerable to a DHCP snooping flaw that allows unauthenticated remote attackers to cause a Denial of Service by improperly forwarding packets across VLAN boundaries.

Vulnerability Details

CVE-ID: CVE-2026-20084

Affected Software: Cisco IOS XE Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability resides in the DHCP snooping feature. An unauthenticated, remote attacker can exploit this by sending specific BOOTP packets, causing the device to forward them between VLANs incorrectly, resulting in system instability or a DoS.

Business Impact

This vulnerability undermines network segmentation and can lead to a complete loss of service for affected network segments. A CVSS score of 8.6 confirms a High severity level, as an attacker can disrupt network operations without requiring any valid credentials or local access.

Remediation Plan

Immediate Action: Apply the relevant Cisco IOS XE security patches immediately to address the DHCP snooping logic error.

Proactive Monitoring: Audit DHCP snooping logs and monitor for unexpected BOOTP traffic patterns originating from untrusted ports.

Compensating Controls: Disable DHCP snooping on interfaces where it is not required, or implement strict VLAN access control lists (VACLs) to limit inter-VLAN traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to trigger a DoS across VLAN boundaries makes this a high-impact flaw for enterprise environments.

Analyst Recommendation

It is strongly recommended to update Cisco IOS XE devices to a fixed release. Maintaining the integrity of DHCP snooping is vital for network security and stability; therefore, applying the primary remediation patch should be prioritized by network security teams.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Management Center (FMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An improper system process at boot time in Cisco FMC allows unauthenticated attackers to bypass authentication and execute scripts via HTTP requests to obtain root OS access.

Executive Summary:
Cisco Secure Firewall Management Center is vulnerable to an unauthenticated authentication bypass that allows remote attackers to execute scripts and gain root access to the operating system.

Vulnerability Details

CVE-ID: CVE-2026-20079

Affected Software: Cisco Secure Firewall Management Center (FMC)

Affected Versions: See vendor advisory

Vulnerability: The flaw stems from an improper system process initialized during the device boot sequence. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to the web interface, bypassing security checks to execute arbitrary commands and scripts with root privileges.

Business Impact

The impact of this vulnerability is critical, as evidenced by its CVSS score of 10.0. An attacker gaining root access to the underlying operating system can completely disable security features, steal sensitive configuration data, and maintain persistent access within the environment. This poses an existential threat to the confidentiality and availability of the managed network security infrastructure.

Remediation Plan

Immediate Action: Apply the software updates provided by Cisco for the Secure Firewall Management Center to resolve the boot-time process flaw.

Proactive Monitoring: Inspect web server logs for anomalous HTTP requests targeting system scripts and monitor for unauthorized changes to the underlying Linux operating system.

Compensating Controls: Implement strict Access Control Lists (ACLs) to ensure that only authorized administrative workstations can reach the FMC web interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. Given that this is an authentication bypass leading to root access, it is a prime target for sophisticated threat actors.

Analyst Recommendation

This vulnerability represents a complete breakdown of the device's security boundary. It is imperative that administrators treat this as a top-priority remediation task. Immediate patching is the only effective way to mitigate the risk of an unauthenticated attacker seizing control of the security management layer.

---METADATA---
VENDOR: Cisco
PRODUCT: Nexus 3600 and 9500-R Series Switches
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the EVPN Layer 2 ingress packet processing of Cisco Nexus switches allows an adjacent attacker to trigger a disruptive Layer 2 traffic loop.

Executive Summary:
Unauthenticated attackers in physical proximity to the network can cause severe network disruption by triggering Layer 2 traffic loops on Cisco Nexus switches.

Vulnerability Details

CVE-ID: CVE-2026-20051

Affected Software: Cisco Nexus 3600 and 9500-R Series Switches

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists in the Ethernet VPN (EVPN) Layer 2 ingress packet processing. An unauthenticated, adjacent attacker can send specially crafted packets to trigger a Layer 2 traffic loop, leading to network congestion and instability.

Business Impact

Layer 2 loops can quickly saturate network bandwidth, causing a complete loss of connectivity for affected segments. Because this attack can be performed without authentication, it poses a high risk to the availability of data center fabrics. The CVSS score of 7.4 reflects the high impact on network availability and the relative ease of exploitation from an adjacent position.

Remediation Plan

Immediate Action: Update the Cisco NX-OS software on affected Nexus 3600 and 9500-R series switches to the recommended fixed release.

Proactive Monitoring: Monitor for sudden spikes in CPU usage and unexpected increases in Layer 2 traffic patterns that may indicate a loop is occurring.

Compensating Controls: Implement port security and Layer 2 loop prevention mechanisms, such as Spanning Tree Protocol (STP) enhancements or storm control, to limit the impact of malicious packets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. This flaw requires the attacker to be on the same local network segment (adjacent).

Analyst Recommendation

This vulnerability represents a significant threat to network uptime. Organizations should apply the necessary NX-OS updates immediately and ensure that Layer 2 security best practices are enforced across the data center fabric.

---METADATA---
VENDOR: Cisco
PRODUCT: Adaptive Security Appliance (ASA) / Threat Defense (FTD)
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in GCM-encrypted IKEv2 IPsec traffic processing in Cisco ASA and FTD software allows authenticated remote attackers to cause a denial of service.

Executive Summary:
An authenticated remote attacker can trigger a denial of service (DoS) condition on Cisco ASA and FTD devices by exploiting a flaw in the processing of specific IPsec traffic.

Vulnerability Details

CVE-ID: CVE-2026-20049

Affected Software: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD)

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists in the way the software processes Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic. An authenticated, remote attacker can exploit this by sending crafted traffic, leading to a system crash and a denial of service (DoS) condition.

Business Impact

With a CVSS score of 7.7, this is a High-severity vulnerability. While it requires authentication, a successful exploit can take down critical VPN and firewall services, leading to significant operational disruption and loss of remote connectivity for the entire organization. This impact on availability can be costly during peak business hours.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco for ASA and FTD software to resolve the IKEv2 processing issue.

Proactive Monitoring: Monitor for frequent, unexplained reboots of the firewall and review IKEv2 negotiation logs for unusual patterns or errors originating from authenticated users.

Compensating Controls: Implement strict peer authentication for IPsec tunnels and limit the number of users with the permissions required to establish GCM-encrypted IKEv2 sessions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation. Because the attacker must be authenticated, the risk is slightly lower than unauthenticated flaws, but it remains a significant threat from malicious insiders or compromised accounts.

Analyst Recommendation

We recommend applying the vendor-supplied patches during the next scheduled maintenance window, or immediately if the firewall is critical for remote access. Ensuring that only trusted individuals have the credentials to establish IPsec sessions is a vital secondary defense.

---METADATA---
VENDOR: Cisco
PRODUCT: Nexus 9000 Series Fabric Switches
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the SNMP subsystem of Cisco Nexus 9000 Series switches could allow an authenticated attacker to cause a denial of service condition.

Executive Summary:
Authenticated attackers can cause a total denial of service on Cisco Nexus 9000 Series switches by exploiting a flaw in the SNMP subsystem.

Vulnerability Details

CVE-ID: CVE-2026-20048

Affected Software: Cisco Nexus 9000 Series Fabric Switches

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the Simple Network Management Protocol (SNMP) subsystem of switches operating in ACI mode. An authenticated, remote attacker can exploit this flaw to trigger a crash or reload of the device, resulting in a denial of service (DoS) condition.

Business Impact

A denial of service on core fabric switches can lead to significant network outages, disrupting data center operations and affecting all connected services. While the attacker must be authenticated, the potential for operational downtime and the high CVSS score of 7.7 make this a significant risk for enterprise networking environments.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco for the Nexus 9000 Series software to resolve the SNMP subsystem flaw.

Proactive Monitoring: Monitor SNMP traffic for unusual polling patterns and review system logs for unexpected reboots or SNMP process crashes.

Compensating Controls: Restrict SNMP access to trusted management hosts using Access Control Lists (ACLs) and use SNMPv3 with strong authentication and encryption.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Cisco has released advisories to assist customers in identifying affected software versions.

Analyst Recommendation

Network stability is critical for business continuity. Administrators should prioritize the patching of Cisco Nexus switches and ensure that SNMP access is strictly controlled to mitigate the risk of an internal DoS attack.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Cisco IOS XR Software's task group assignment allows local authenticated attackers to gain full administrative control over the device.

Executive Summary:
Flawed task group assignment for specific CLI commands in Cisco IOS XR allows local authenticated users to elevate their privileges to full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-20046

Affected Software: Cisco IOS XR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is located within the task group assignment logic for a specific CLI command. An authenticated, local attacker can exploit this logic flaw to bypass intended permission restrictions and gain unauthorized administrative rights.

Business Impact

The ability for a low-privileged user to elevate to full administrative control poses a severe threat to network security. An attacker could reconfigure the entire network backbone, disable security features, or cause prolonged service outages. The CVSS score of 8.8 underscores the critical nature of this privilege escalation, which effectively negates internal access controls.

Remediation Plan

Immediate Action: Install the latest software maintenance updates from Cisco to correct the task group assignment logic and prevent unauthorized privilege elevation.

Proactive Monitoring: Audit user task group assignments and review command execution logs for any unauthorized use of administrative-level commands by non-admin accounts.

Compensating Controls: Use external TACACS+ or RADIUS servers to strictly enforce command-level authorization and provide a centralized audit trail of all user actions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Privilege escalation flaws are highly sought after by attackers who have already gained a foothold in a network to expand their reach.

Analyst Recommendation

Elevating privileges to administrative levels allows an attacker to bypass almost all security boundaries on the device. It is imperative that administrators apply the relevant Cisco updates immediately. Until patching is complete, perform a comprehensive review of all local user permissions and task group memberships to ensure no accounts have been granted excessive rights.

Executive Summary:
A critical vulnerability has been identified in multiple Cisco Unified Communications products, which are central to enterprise telephony and collaboration services. This flaw allows a remote attacker, without any credentials, to take complete control of an affected system, potentially leading to widespread service disruption, interception of sensitive communications, and unauthorized access to the internal network. Due to active exploitation in the wild, this vulnerability represents a significant and immediate threat to the organization.

Vulnerability Details

CVE-ID: CVE-2026-20045

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability allows for unauthenticated remote code execution. An attacker can send a specially crafted request over the network to a vulnerable device. Successful exploitation does not require any prior authentication, meaning the attacker needs no username or password. This allows the attacker to execute arbitrary commands on the underlying operating system with the privileges of the application, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. A successful exploit would have a severe impact on business operations. An attacker could disrupt or disable critical communication services, intercept sensitive voice and data communications, access confidential information, or use the compromised system as a beachhead to launch further attacks against the internal network. The potential consequences include significant operational downtime, regulatory fines, reputational damage, and the compromise of sensitive corporate data.

Remediation Plan

Immediate Action: The primary and most critical action is to apply the security updates provided by Cisco to all affected devices immediately. Before applying the patch, review system logs and network traffic for any signs of compromise. After patching, continue to monitor for any post-breach activity.

Proactive Monitoring: Implement enhanced monitoring for affected systems. Security teams should look for unusual network traffic patterns originating from the Cisco devices, unexpected processes or services running, unauthorized configuration changes, and suspicious command execution in system and audit logs. Utilize network intrusion detection/prevention systems (IDS/IPS) with updated signatures to detect and block exploit attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Restrict network access to the management interfaces of affected devices to a minimal set of trusted IP addresses using firewalls or access control lists (ACLs). Place the devices behind a web application firewall (WAF) or an IPS that has rules to inspect traffic for known exploit patterns.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of January 22, 2026, this vulnerability is confirmed to be actively exploited in the wild. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog underscores the high-risk nature of this flaw. The short deadline of February 10, 2026, for U.S. federal agencies to apply patches indicates that threat actors are widely and successfully leveraging this vulnerability.

Analyst Recommendation

Given the high severity, lack of authentication required for exploitation, and confirmed active attacks in the wild, this vulnerability must be treated as a critical priority. We strongly recommend that the organization initiate emergency patching procedures to apply the vendor-supplied updates to all affected Cisco products immediately. The inclusion of this CVE in the CISA KEV catalog signifies a clear and present danger; failure to remediate promptly presents an unacceptable risk of system compromise, data breach, and severe disruption to business-critical communication services.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the Cisco IOS XR CLI allows local, authenticated users to execute arbitrary commands with root privileges on the underlying operating system.

Executive Summary:
An authenticated, local attacker can exploit a vulnerability in the Cisco IOS XR Command Line Interface to execute arbitrary commands with root-level privileges on the underlying operating system.

Vulnerability Details

CVE-ID: CVE-2026-20040

Affected Software: Cisco IOS XR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists in the CLI component of Cisco IOS XR Software. A local attacker with valid credentials could input specifically crafted arguments to a CLI command to bypass environment restrictions and execute system-level commands as the root user.

Business Impact

A successful exploit grants the attacker total control over the affected network device. With root access, an adversary can intercept network traffic, modify device configurations, or establish persistent backdoors, leading to a complete loss of confidentiality, integrity, and availability. The High severity rating of CVSS 8.8 reflects the significant risk of full system compromise despite the requirement for local authentication.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco for IOS XR Software immediately to patch the CLI command processing logic.

Proactive Monitoring: Review AAA (Authentication, Authorization, and Accounting) logs for unusual CLI command patterns and monitor for unauthorized changes to the underlying filesystem.

Compensating Controls: Implement the principle of least privilege by restricting CLI access to only necessary personnel and utilizing multi-factor authentication for all administrative sessions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw allowing root access, the potential for exploitation by malicious insiders or attackers with established persistence is high.

Analyst Recommendation

This vulnerability represents a significant risk to infrastructure integrity as it allows for a complete escape from the restricted CLI environment to the root operating system. Organizations should prioritize the deployment of vendor-supplied patches. In the interim, strictly audit all local account activities and limit the number of users with CLI access to the absolute minimum required for operations.