---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: Release 20.9.9.1 and earlier, 20.12.7.1 and earlier, 20.15.4.4 and earlier, 20.15.5.2 and earlier, 20.18.3, and 26.1.1.1 and earlier.
---END_METADATA---

Description Summary:
Cisco Catalyst SD-WAN Manager contains an arbitrary file write vulnerability in its web UI, allowing authenticated remote attackers to escalate privileges to root.

Executive Summary:
This critical vulnerability is currently being exploited in the wild and allows an authenticated attacker to achieve full system compromise via arbitrary file writes.

Vulnerability Details

CVE-ID: CVE-2026-20262

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: Cisco Catalyst SD-WAN Manager Release 20.9.9.1 and earlier, 20.12.7.1 and earlier, 20.15.4.4 and earlier, 20.15.5.2 and earlier, 20.18.3, and 26.1.1.1 and earlier.

Vulnerability: This is an arbitrary file write flaw resulting from insufficient input validation during file uploads in the web UI. An authenticated attacker with at least write access can overwrite critical system files to achieve root-level code execution.

Business Impact

With a CVSS score of 9.5, this vulnerability represents a severe risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the SD-WAN Manager, potentially impacting network-wide traffic, data confidentiality, and system integrity. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog underscores the immediate necessity for remediation.

Remediation Plan

Immediate Action: Upgrade to the patched versions: Cisco Catalyst SD-WAN Release 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2.

Proactive Monitoring: Review system logs for the presence of unexpected files, particularly those named "suspicious.war," or requests to unauthorized webpages.

Compensating Controls: Restrict access to the web UI to trusted management networks and implement strict role-based access control (RBAC) to minimize the number of users with write permissions.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 14, 2026, confirmed active exploitation has been observed in the wild. Attackers have been seen uploading malicious files to gain unauthorized access.

Analyst Recommendation

Given that this vulnerability is actively exploited and carries a critical CVSS score, immediate patching is required. Organizations must prioritize upgrading all affected instances, including On-Prem, Cloud-Pro, and FedRAMP installations, to the specified fixed versions to neutralize this threat.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator, affecting all Cisco SD-WAN deployment types: on-prem, Cloud-Pro, Cloud (Cisco Managed), and for Government (FedRAMP).
---END_METADATA---

Description Summary:
A command injection and privilege escalation vulnerability exists in the CLI of Cisco Catalyst SD-WAN Manager due to insufficient input validation.

Executive Summary:
Cisco Catalyst SD-WAN Manager is vulnerable to a critical command injection flaw that is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-20245

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator, affecting all Cisco SD-WAN deployment types: on-prem, Cloud-Pro, Cloud (Cisco Managed), and for Government (FedRAMP).

Vulnerability: This is a command injection and privilege escalation vulnerability in the CLI of Cisco Catalyst SD-WAN Manager. While exploitation requires an attacker to possess netadmin privileges—which can be obtained through valid credentials or by chaining other vulnerabilities like CVE-2026-20182 or CVE-2026-20127—the flaw allows for unauthorized configuration changes to be pushed to edge devices.

Business Impact

The CVSS score of 9.5 reflects the extreme severity of this vulnerability. Successful exploitation permits attackers to manipulate network configurations, potentially leading to widespread network disruption, man-in-the-middle attacks, or complete compromise of the SD-WAN infrastructure. The active exploitation observed in the wild significantly elevates the urgency of this advisory.

Remediation Plan

Immediate Action: Review the Cisco security advisory (cisco-sa-sdwan-rpa2-v69WY2SW) and apply all recommended mitigations immediately.

Proactive Monitoring: Monitor CLI logs for unauthorized command execution and audit configuration change logs for any unexpected modifications to edge devices.

Compensating Controls: Restrict administrative access to the SD-WAN Manager CLI to only essential personnel and enforce strict multi-factor authentication (MFA) to mitigate the risk of credential-based access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of June 9, 2026, CISA has confirmed this vulnerability is being actively leveraged by attackers. Cisco has observed limited cases where exploitation resulted in configuration changes pushed to edge devices. Immediate action is required to secure affected environments.

Analyst Recommendation

Given the critical severity and confirmed active exploitation, organizations must prioritize the remediation of this vulnerability. Administrators should consult the vendor advisory immediately to implement the necessary mitigations and ensure that administrative access is strictly controlled to prevent the initial compromise required for exploitation.

---METADATA---
VENDOR: Cisco
PRODUCT: Unified Communications Manager (Unified CM)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to perform arbitrary file operations and escalate privileges to root.

Executive Summary:
A critical SSRF vulnerability in Cisco Unified Communications Manager allows an unauthenticated, remote attacker to execute arbitrary file operations and potentially gain root-level system access.

Vulnerability Details

CVE-ID: CVE-2026-20230

Affected Software: Cisco Unified Communications Manager (Unified CM) and Session Management Edition (SME)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a server-side request forgery (SSRF) flaw that does not require authentication. It allows remote attackers to force the application to perform unauthorized requests, leading to arbitrary file operations on the underlying OS and potential privilege escalation to root.

Business Impact

The CVSS score of 8.6 indicates a severe risk to internal infrastructure. Because this vulnerability allows an unauthenticated attacker to manipulate file operations and gain root access, the potential impact includes total compromise of the communications server, unauthorized access to sensitive call data, and potential lateral movement into the core network.

Remediation Plan

Immediate Action: Consult the official Cisco security advisory and apply the necessary patches or software upgrades immediately.

Proactive Monitoring: Inspect network traffic to and from the Unified CM server for anomalous requests or unauthorized outbound connections that suggest SSRF activity.

Compensating Controls: Restrict network access to the management interface of the Unified CM to trusted internal segments only, and utilize a WAF to block malformed or suspicious HTTP requests.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for an unauthenticated attacker to gain root access, this vulnerability must be treated with the highest urgency. IT administrators should verify the version of their Cisco Unified CM deployment and apply relevant security updates as soon as they are made available by the vendor.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Workload
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Cisco Secure Workload contains an access validation flaw in internal REST APIs that permits unauthenticated, remote attackers to perform unauthorized configuration changes as a Site Admin.

Executive Summary:
An unauthenticated remote code execution vulnerability in Cisco Secure Workload allows attackers to bypass authentication and gain full administrative control over site resources.

Vulnerability Details

CVE-ID: CVE-2026-20223

Affected Software: Cisco Secure Workload

Affected Versions: See vendor advisory

Vulnerability: This is an authentication bypass vulnerability affecting internal REST API endpoints. Unauthenticated attackers can send specifically crafted requests to these endpoints, successfully masquerading as a Site Admin user.

Business Impact

A successful exploitation grants an attacker full administrative privileges, leading to unauthorized data exfiltration, modification of network security policies, and complete compromise of the Secure Workload environment. Given the critical CVSS score of 10.0, this vulnerability presents an immediate, catastrophic risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Cisco immediately.

Proactive Monitoring: Audit REST API access logs for anomalous, high-privilege requests originating from unauthorized or external IP addresses.

Compensating Controls: Implement strict network segmentation and restrict access to the Secure Workload management interfaces to trusted administrative subnets only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw necessitates immediate remediation. Administrators must prioritize applying vendor-supplied updates to all affected Secure Workload instances to close the authentication bypass vector and prevent unauthorized administrative access.

---METADATA---
VENDOR: Cisco
PRODUCT: Identity Services Engine (ISE)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
A command injection vulnerability in Cisco Identity Services Engine allows authenticated remote attackers to execute arbitrary OS commands and potentially gain root privileges.

Executive Summary:
An authenticated remote command execution vulnerability in Cisco Identity Services Engine (ISE) poses a critical risk to network infrastructure and system availability.

Vulnerability Details

CVE-ID: CVE-2026-20186

Affected Software: Cisco Identity Services Engine (ISE)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability arises from insufficient input validation, allowing an attacker with at least Read Only Admin credentials to execute arbitrary OS commands via crafted HTTP requests. Successful exploitation grants user-level access, which can be further escalated to root privileges or result in a denial-of-service condition.

Business Impact

The compromise of Cisco ISE infrastructure can lead to full system takeover and unauthorized access to critical network management functions. With a CVSS score of 9.9, this vulnerability represents a severe threat; if exploited, an attacker could disrupt network authentication services, causing widespread connectivity loss for endpoints and significant operational downtime.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Cisco to all affected ISE nodes immediately.

Proactive Monitoring: Review administrative access logs for anomalous HTTP requests and audit command execution history on ISE appliances.

Compensating Controls: Restrict administrative network access to ISE management interfaces to trusted, hardened management subnets or via VPN.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the potential for root-level access, the risk remains significant.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for complete system compromise, organizations should prioritize patching Cisco ISE environments. Administrators must audit existing administrative accounts to ensure the principle of least privilege is strictly enforced while awaiting the vendor's update.

---METADATA---
VENDOR: Cisco
PRODUCT: Webex Services
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
An improper certificate validation flaw in Cisco Webex Services allowed unauthenticated attackers to impersonate users via crafted tokens.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Webex Services could have permitted unauthenticated attackers to impersonate legitimate users and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-20184

Affected Software: Cisco Webex Services

Affected Versions: See vendor advisory

Vulnerability: The vulnerability stemmed from improper certificate validation during the integration of single sign-on (SSO) with Control Hub. An unauthenticated remote attacker could exploit this by supplying a crafted token to a service endpoint to bypass authentication.

Business Impact

A successful exploit allows for full account impersonation, potentially leading to the unauthorized access of sensitive corporate communications, meetings, and data stored within Cisco Webex. With a CVSS score of 9.8, this flaw presents a severe risk to organizational confidentiality and identity integrity, requiring immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: Update all Cisco Webex service integrations to the latest version provided by the vendor.

Proactive Monitoring: Review Webex audit logs for suspicious login patterns or unauthorized access attempts originating from unrecognized tokens.

Compensating Controls: Ensure that all SSO integrations are strictly configured to require valid, verified certificates and monitor authentication traffic for anomalies.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw poses a significant risk to organizational identity security.

Analyst Recommendation

This vulnerability is highly critical due to the potential for unauthenticated impersonation within an enterprise communication platform. Organizations must ensure that all Webex integrations are updated immediately and review their SSO configurations to ensure that certificate validation is correctly enforced.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A vulnerability in the control connection handshaking of Cisco Catalyst SD-WAN allows unauthenticated, remote attackers to bypass authentication and obtain administrative access.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN control connections is being actively exploited in the wild, posing an immediate threat to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-20182

Affected Software: Cisco Catalyst SD-WAN

Affected Versions: See vendor advisory

Vulnerability: This flaw exists within the control connection handshaking process, enabling an unauthenticated attacker to bypass authentication. Exploitation allows the attacker to log in as a high-privileged user and manipulate the SD-WAN fabric via NETCONF.

Business Impact

Assigned a CVSS score of 10.0, this vulnerability permits full administrative control over the SD-WAN fabric. Successful exploitation could result in complete compromise of network traffic, unauthorized data exfiltration, and significant disruption to enterprise-wide network operations.

Remediation Plan

Immediate Action: Update all Cisco Catalyst SD-WAN components to the latest version provided by the vendor to address the control connection handshake flaw.

Proactive Monitoring: Utilize the vendor-provided "Show Control Connections" guidance to verify system integrity and identify anomalous connection attempts.

Compensating Controls: Deploy strict firewall rules to limit management plane access and monitor for unauthorized administrative sessions.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 14, 2026, this vulnerability is confirmed to be under active exploitation in the wild. This issue serves as a critical follow-up to previous SD-WAN vulnerabilities and requires immediate attention to prevent unauthorized fabric manipulation.

Analyst Recommendation

Organizations must treat this as a high-priority incident. Beyond applying the necessary updates, security teams should conduct a thorough audit of all control plane connections and review logs for signs of compromise to ensure the environment has not been subverted by attackers.

---METADATA---
VENDOR: Cisco
PRODUCT: Identity Services Engine (ISE)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
A command injection vulnerability in Cisco Identity Services Engine allows authenticated remote attackers to execute arbitrary OS commands and potentially gain root privileges.

Executive Summary:
An authenticated remote command execution vulnerability in Cisco Identity Services Engine (ISE) poses a critical risk to network infrastructure and system availability.

Vulnerability Details

CVE-ID: CVE-2026-20180

Affected Software: Cisco Identity Services Engine (ISE)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is caused by insufficient validation of user-supplied input, allowing an authenticated attacker (Read Only Admin level or higher) to execute arbitrary commands on the underlying operating system. Exploitation can result in root-level privilege escalation or a denial-of-service condition affecting network authentication.

Business Impact

The impact of this vulnerability is severe, as it allows attackers to move from an authenticated administrative state to full system control. With a CVSS score of 9.9, this vulnerability threatens the integrity and availability of the entire network identity infrastructure, potentially resulting in widespread service outages and unauthorized access to sensitive internal network segments.

Remediation Plan

Immediate Action: Update Cisco Identity Services Engine to the latest version as specified in the official vendor security advisory.

Proactive Monitoring: Monitor system logs for unexpected process execution and verify that administrative access is restricted to authorized personnel only.

Compensating Controls: Implement strict firewall rules to limit access to the ISE management interface to essential administrative workstations only.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. Given the critical nature of the flaw, however, immediate remediation is strongly advised.

Analyst Recommendation

Due to the extreme risk posed by command injection in a centralized security appliance like Cisco ISE, organizations must treat this as a high-priority update. Administrators should verify their current version against the vendor's updated release and perform the upgrade as soon as possible to mitigate the risk of privilege escalation and DoS.

---METADATA---
VENDOR: Cisco
PRODUCT: Smart Software Manager On-Prem (SSM On-Prem)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
The exposure of an internal service in Cisco SSM On-Prem allows unauthenticated remote attackers to execute arbitrary commands with root privileges via crafted API requests.

Executive Summary:
Cisco Smart Software Manager On-Prem is vulnerable to unauthenticated remote code execution with root privileges due to the unintentional exposure of an internal service API.

Vulnerability Details

CVE-ID: CVE-2026-20160

Affected Software: Cisco Smart Software Manager On-Prem (SSM On-Prem)

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: This flaw is caused by the exposure of an internal service's API. An unauthenticated remote attacker can send crafted requests to this API to execute arbitrary commands on the host operating system with root-level privileges.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this RCE vulnerability. Root-level access allows an attacker to completely take over the SSM On-Prem host, steal licensing data, and use the system as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Update Cisco SSM On-Prem to the latest available version to close the exposed service and secure the API.

Proactive Monitoring: Review system logs for unauthorized command execution and inspect network traffic for unusual API calls directed at internal-only service ports.

Compensating Controls: Implement strict firewall rules to ensure that only authorized administrative IPs can access the SSM On-Prem management and API ports.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. Remote code execution with root privileges is a critical threat that requires immediate remediation.

Analyst Recommendation

Applying the Cisco-provided patch is essential to prevent total system compromise. Organizations should also audit their network architecture to ensure that internal services are not reachable from outside the intended management segment.

---METADATA---
VENDOR: Cisco
PRODUCT: Identity Services Engine (ISE) and ISE-PIC
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch, exploit_status
---END_METADATA---

Description Summary:
Cisco ISE and ISE-PIC are vulnerable to OS command injection via crafted HTTP requests, allowing authenticated administrators to achieve root-level code execution and cause denial-of-service.

Executive Summary:
An authenticated remote command execution vulnerability in Cisco ISE and ISE-PIC poses a critical risk of full system compromise and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-20147

Affected Software: Cisco ISE and ISE-PIC

Affected Versions: See vendor advisory

Vulnerability: This vulnerability allows an authenticated remote attacker with valid administrative credentials to execute arbitrary OS commands due to insufficient input validation. Successful exploitation can lead to privilege escalation to root and, in single-node environments, a complete denial-of-service condition.

Business Impact

The ability for an attacker to gain root access to an authentication server represents a catastrophic security failure. Given the CVSS score of 9.9, this vulnerability threatens the integrity and availability of the entire network access control infrastructure, potentially allowing lateral movement across the enterprise.

Remediation Plan

Immediate Action: Update Cisco ISE and ISE-PIC to the latest patched versions provided by the vendor immediately.

Proactive Monitoring: Review administrative access logs for suspicious HTTP requests and monitor system resource usage for unexpected service interruptions.

Compensating Controls: Restrict access to the ISE management interface to known, trusted management subnets using network-level ACLs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high severity and the potential for root-level access, the risk remains significant.

Analyst Recommendation

Organizations must prioritize the application of Cisco security patches to all affected ISE nodes. Given that administrative credentials are required for exploitation, ensure that Principle of Least Privilege is strictly enforced for all administrative accounts to minimize the attack surface.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Management Center (FMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A critical insecure deserialization flaw in the Cisco FMC web interface allows unauthenticated remote attackers to execute arbitrary Java code with root privileges via crafted serial objects.

Executive Summary:
An unauthenticated remote attacker can gain full root-level control over the Cisco Secure Firewall Management Center by exploiting an insecure Java deserialization vulnerability.

Vulnerability Details

CVE-ID: CVE-2026-20131

Affected Software: Cisco Secure Firewall Management Center (FMC)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability exists in the web-based management interface due to the insecure deserialization of user-supplied Java byte streams. An unauthenticated remote attacker can trigger this flaw by sending a crafted serialized Java object, leading to arbitrary code execution as the root user.

Business Impact

Successful exploitation results in a total compromise of the management platform, allowing attackers to manipulate firewall policies, intercept traffic, or pivot into the internal network. With a CVSS score of 10.0, this represents the highest possible risk to organizational security and infrastructure integrity. The ability for an unauthenticated actor to achieve root access necessitates immediate intervention to prevent catastrophic data loss or system downtime.

Remediation Plan

Immediate Action: Update Cisco Secure Firewall Management Center to the latest patched version immediately as specified in the Cisco Security Advisory.

Proactive Monitoring: Monitor network traffic for unusual POST requests to the FMC web interface and audit system logs for unauthorized "root" account activity or unexpected Java process executions.

Compensating Controls: Restrict access to the FMC management interface to trusted internal networks only and deploy a Web Application Firewall (WAF) to filter serialized Java objects.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical role of FMC in network security, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated; a CVSS 10.0 rating indicates a critical risk to the entire network perimeter. Organizations must prioritize the application of the vendor-supplied patch immediately. Until patching is complete, ensure the management interface is not exposed to the public internet to reduce the attack surface.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A peering authentication flaw in Cisco Catalyst SD-WAN controllers allows unauthenticated, remote attackers to bypass authentication and gain administrative privileges.

Executive Summary:
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN has been identified and is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-20127

Affected Software: Cisco Catalyst SD-WAN

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a failure in the peering authentication mechanism, allowing an unauthenticated remote attacker to send crafted requests to the system. Successful exploitation grants the attacker administrative access to the SD-WAN fabric via NETCONF.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk to organizational infrastructure. An attacker gaining administrative control over the SD-WAN fabric can manipulate network traffic, intercept sensitive data, or disrupt critical business communications, leading to severe reputational damage and operational downtime.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Cisco immediately to resolve the authentication bypass.

Proactive Monitoring: Review system and network access logs for unusual NETCONF activity or unauthorized administrative logins.

Compensating Controls: Implement strict network segmentation and restrict access to the SD-WAN control plane to trusted management IP addresses only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Feb 25, 2026, this vulnerability is confirmed to be under active exploitation in the wild. Given the critical nature of the flaw and the evidence of exploitation, immediate patching is mandatory for all affected Cisco Catalyst SD-WAN deployments.

Analyst Recommendation

The extreme severity of this vulnerability, combined with confirmed active exploitation, necessitates an immediate emergency response. Organizations should prioritize patching all Cisco Catalyst SD-WAN controllers and perform a thorough forensic review of their network configurations to ensure no unauthorized changes have been introduced.

---METADATA---
VENDOR: Cisco
PRODUCT: Catalyst SD-WAN Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager allows an authenticated, local attacker with low-level privileges to gain root access to the underlying operating system.

Executive Summary:
Cisco Catalyst SD-WAN Manager is vulnerable to a local privilege escalation flaw that allows authenticated users with minimal permissions to gain full root-level control over the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-20126

Affected Software: Cisco Catalyst SD-WAN Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists within the underlying operating system management component of the SD-WAN Manager. It allows a local, authenticated attacker with low-level access to bypass security restrictions and elevate their privileges to root (superuser).

Business Impact

A successful exploit grants the attacker total control over the SD-WAN Manager, which is a central orchestration point for network infrastructure. This could lead to the interception of sensitive network traffic, unauthorized configuration changes, and complete compromise of the SD-WAN fabric. The CVSS score of 8.8 reflects the high severity of allowing a low-privileged user to achieve administrative dominance over a critical networking asset.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to all affected Catalyst SD-WAN Manager instances.

Proactive Monitoring: Audit local user accounts for unauthorized privilege changes and review system logs for unusual commands executed with root permissions.

Compensating Controls: Restrict local access to the SD-WAN Manager interface to only essential personnel using the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its impact on core network infrastructure, the potential for exploitation is high once a proof-of-concept is developed.

Analyst Recommendation

This vulnerability represents a significant risk to organizational network integrity. Administrators must prioritize the deployment of vendor-supplied patches to prevent internal actors or compromised accounts from seizing control of the SD-WAN environment. Immediate remediation is the only effective way to mitigate this high-severity risk.

---METADATA---
VENDOR: Cisco
PRODUCT: TelePresence Collaboration Endpoint (CE) / RoomOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the text rendering subsystem of Cisco TelePresence CE and RoomOS allows unauthenticated remote attackers to cause a denial of service (DoS) condition.

Executive Summary:
Unauthenticated remote attackers can trigger a denial of service on Cisco TelePresence and RoomOS devices by exploiting a vulnerability in the text rendering subsystem.

Vulnerability Details

CVE-ID: CVE-2026-20119

Affected Software: Cisco TelePresence CE Software and RoomOS Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The flaw exists within the text rendering subsystem of the device software. An unauthenticated, remote attacker can exploit this by sending malicious input that the system fails to process correctly, resulting in a device crash or reboot.

Business Impact

Exploitation of this vulnerability directly impacts the availability of collaboration services, leading to system downtime during critical meetings. While the CVSS score is 7.5, the High severity reflects the potential for repeated disruption of business-critical video conferencing hardware across the enterprise.

Remediation Plan

Immediate Action: Update affected Cisco TelePresence and RoomOS devices to the latest patched versions as specified in the Cisco security advisory.

Proactive Monitoring: Monitor network traffic for unusual packets targeting collaboration endpoints and track device uptime for unexpected reboots.

Compensating Controls: Implement network-level access control lists (ACLs) to ensure only authorized traffic can reach the management and signaling interfaces of the devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. Denial of Service vulnerabilities are often utilized to mask other malicious activities or cause widespread operational friction.

Analyst Recommendation

To maintain the availability of organizational communication channels, it is essential to apply the vendor's updates. Prioritize patching devices that are exposed to broader internal networks or the public internet.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authenticated remote attacker with valid VPN credentials can exhaust device memory on Cisco ASA and FTD systems, leading to a Denial of Service for new SSL VPN connections.

Executive Summary:
A vulnerability in Cisco Secure Firewalls allows authenticated VPN users to trigger memory exhaustion, effectively blocking all subsequent remote access attempts to the network.

Vulnerability Details

CVE-ID: CVE-2026-20105

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Remote Access SSL VPN functionality. An authenticated, remote attacker with a valid VPN connection can perform actions that lead to the exhaustion of device memory, resulting in a Denial of Service (DoS) for all new incoming VPN connections.

Business Impact

The CVSS score of 7.7 indicates a High-severity risk to availability. By exhausting system memory, an attacker can prevent legitimate employees from establishing new secure connections, paralyzing remote operations. This type of attack is particularly damaging as it may persist until the device is manually cleared or rebooted, impacting productivity and incident response.

Remediation Plan

Immediate Action: Deploy the recommended security updates from Cisco to all affected ASA and FTD appliances immediately.

Proactive Monitoring: Implement granular monitoring of memory pools on firewall devices and configure SNMP traps to alert administrators when memory utilization exceeds 80%.

Compensating Controls: Use strict egress filtering and session limits per user to mitigate the speed and scale at which an authenticated attacker can consume system resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. Although authentication is required, internal threats or compromised endpoints could easily leverage this flaw to disrupt operations.

Analyst Recommendation

Immediate patching is recommended to maintain the integrity of remote access services. Administrators should prioritize these updates to ensure that a single compromised account cannot be used to deny service to the entire organization. Regular audits of VPN user accounts and permissions are also advised.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unauthenticated, remote vulnerability in Cisco ASA and FTD Software allows attackers to exhaust device memory via SSL VPN functionality, leading to a persistent Denial of Service (DoS) condition.

Executive Summary:
Cisco Secure Firewall devices are vulnerable to an unauthenticated remote memory exhaustion attack that can result in a complete Denial of Service for all new SSL VPN connections.

Vulnerability Details

CVE-ID: CVE-2026-20103

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw exists in the Remote Access SSL VPN functionality where an unauthenticated, remote attacker can send crafted traffic to trigger memory exhaustion. Successful exploitation prevents the device from accepting new VPN connections, effectively halting remote access capabilities.

Business Impact

A successful exploit poses a significant threat to business continuity by disabling remote access for the entire workforce. With a CVSS score of 8.6, this High-severity vulnerability could lead to significant operational downtime and prevent employees from accessing critical internal resources. The lack of authentication requirements increases the likelihood of opportunistic attacks.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to patch the affected ASA and FTD software versions.

Proactive Monitoring: Monitor device memory utilization metrics and set alerts for sudden, unexplained spikes that could indicate an ongoing exhaustion attack.

Compensating Controls: Implement infrastructure access control lists (ACLs) to limit SSL VPN access to known IP ranges if feasible, reducing the exposed attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the unauthenticated nature of the flaw and the critical role of VPN gateways, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of authentication required for exploitation, necessitates immediate remediation. Security teams should prioritize patching all internet-facing Cisco Secure Firewall appliances. Failure to act could result in a total loss of remote connectivity for the organization.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall ASA and FTD Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authenticated vulnerability in the LUA interpreter of Cisco ASA and FTD SSL VPN features allows remote attackers with valid credentials to cause an unexpected device reload and Denial of Service.

Executive Summary:
Authenticated users with valid VPN access can trigger a remote device reload on Cisco Secure Firewalls, causing an immediate and disruptive Denial of Service condition.

Vulnerability Details

CVE-ID: CVE-2026-20100

Affected Software: Cisco Secure Firewall ASA and FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides in the LUA interpreter used within the Remote Access SSL VPN feature. An authenticated, remote attacker with a valid VPN connection can execute specific commands that cause the device to crash and reload unexpectedly.

Business Impact

While this exploit requires authentication, it allows any user with valid VPN credentials—including compromised accounts—to take the entire firewall offline. The CVSS score of 7.7 reflects a High-severity risk where system availability is compromised, leading to immediate disconnection of all active sessions and potential data loss during the reboot cycle.

Remediation Plan

Immediate Action: Apply the latest software patches from Cisco to resolve the LUA interpreter flaw in the ASA and FTD platforms.

Proactive Monitoring: Review VPN session logs for unusual activity and monitor system uptime logs for unexpected reboots or "last reload" reasons related to software forced crashes.

Compensating Controls: Enforce multi-factor authentication (MFA) for all VPN users to reduce the risk of an attacker using compromised credentials to trigger this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for a valid VPN connection provides some mitigation, but the impact of a device reload remains critical for availability.

Analyst Recommendation

Organizations should treat this as a high-priority update, especially if they have a large number of VPN users. Patching the LUA interpreter is the only definitive way to prevent authenticated users from disrupting network services. Ensure that all security appliances are updated during the next available maintenance window.

---METADATA---
VENDOR: Cisco
PRODUCT: Meeting Management
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A flaw in the Certificate Management feature of Cisco Meeting Management allows authenticated attackers to upload files and execute commands with root privileges.

Executive Summary:
Cisco Meeting Management is vulnerable to an authenticated remote attack that enables arbitrary file uploads and command execution with full root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-20098

Affected Software: Cisco Meeting Management

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the Certificate Management component. An authenticated, remote attacker with sufficient privileges can exploit this flaw to upload unauthorized files, leading to arbitrary command execution and an elevation of privileges to the root level.

Business Impact

The impact of this vulnerability is severe, as it grants an attacker total control over the Cisco Meeting Management system. With a CVSS score of 8.8, a successful exploit could result in a complete compromise of the underlying operating system, data theft, and the disruption of critical communication services.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco immediately to address the flaws in the Certificate Management feature.

Proactive Monitoring: Review system logs for unauthorized certificate uploads or unexpected administrative commands executed within the management interface.

Compensating Controls: Restrict access to the Cisco Meeting Management interface to trusted internal networks and utilize Multi-Factor Authentication (MFA) to mitigate account compromise risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to achieve root access makes this a high-priority target for internal or compromised-account threats.

Analyst Recommendation

Administrators must treat this as a critical update due to the privilege escalation path to root. Immediate patching is recommended to protect the integrity of the meeting infrastructure and prevent lateral movement from the management server.

---METADATA---
VENDOR: Cisco
PRODUCT: Integrated Management Controller (IMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An authentication bypass in Cisco IMC's password change functionality allows unauthenticated remote attackers to reset any user's password and gain administrative access.

Executive Summary:
Cisco Integrated Management Controllers (IMC) are subject to a critical authentication bypass that allows remote attackers to seize administrative control by improperly handling password change requests.

Vulnerability Details

CVE-ID: CVE-2026-20093

Affected Software: Cisco Integrated Management Controller (IMC)

Affected Versions: See vendor advisory for specific affected firmware versions.

Vulnerability: The vulnerability stems from incorrect handling of HTTP password change requests. An unauthenticated, remote attacker can send a crafted request to bypass security checks and reset the password of any user, including the Admin account.

Business Impact

With a CVSS score of 9.8, the impact is severe. An attacker gaining Admin access to the IMC can control the underlying physical server, modify firmware, access data, and potentially brick the hardware, leading to catastrophic operational failure.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Cisco for the Integrated Management Controller to patch the password handling logic.

Proactive Monitoring: Monitor web management logs for successful password changes that were not initiated by authorized personnel and check for anomalous HTTP requests.

Compensating Controls: Disable public internet access to the IMC management interface and restrict access to a dedicated, isolated management VLAN with strict ACLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation. The ability to gain Admin rights remotely without credentials makes this a high-priority fix.

Analyst Recommendation

Organizations must treat this as a top-priority security event. Ensure that all Cisco IMC instances are updated immediately and that management interfaces are never exposed to untrusted networks.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Wireless Controller Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in CAPWAP packet processing in Cisco IOS XE Wireless Controller Software allows unauthenticated remote attackers to cause a Denial of Service.

Executive Summary:
Unauthenticated remote attackers can trigger a Denial of Service condition on Cisco Catalyst CW9800 devices by exploiting a flaw in the processing of CAPWAP packets.

Vulnerability Details

CVE-ID: CVE-2026-20086

Affected Software: Cisco IOS XE Wireless Controller Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists in the way the software processes Control and Provisioning of Wireless Access Points (CAPWAP) packets. An unauthenticated, remote attacker can send specially crafted CAPWAP packets to an affected device, causing it to crash or reload, resulting in a Denial of Service (DoS) condition.

Business Impact

This vulnerability carries a CVSS score of 8.6, placing it in the High-severity category. A successful exploit directly impacts business continuity by disabling wireless network connectivity for the entire coverage area of the affected controller. This can lead to significant operational downtime, loss of productivity, and disruption of critical wireless services.

Remediation Plan

Immediate Action: Administrators should apply the latest Cisco IOS XE software updates for the Catalyst CW9800 family to patch the CAPWAP processing logic.

Proactive Monitoring: Enable logging for CAPWAP traffic and monitor for high rates of malformed packets or unexpected controller reboots, which may indicate an ongoing DoS attack.

Compensating Controls: Utilize infrastructure access control lists (iACLs) to permit CAPWAP traffic only from trusted Access Point IP addresses, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation of this vulnerability. Because the attack is unauthenticated and remote, it is a highly attractive target for disruption-focused threat actors.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and its direct impact on network availability, this patch should be treated as a critical priority. Organizations utilizing Cisco Catalyst CW9800 series controllers must update their IOS XE firmware immediately to maintain service availability.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XE Software
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A flaw in the DHCP snooping feature of Cisco IOS XE allows unauthenticated attackers to cause BOOTP packets to be forwarded between VLANs. This leads to a Denial of Service (DoS) condition.

Executive Summary:
Cisco IOS XE Software is vulnerable to a DHCP snooping flaw that allows unauthenticated remote attackers to cause a Denial of Service by improperly forwarding packets across VLAN boundaries.

Vulnerability Details

CVE-ID: CVE-2026-20084

Affected Software: Cisco IOS XE Software

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability resides in the DHCP snooping feature. An unauthenticated, remote attacker can exploit this by sending specific BOOTP packets, causing the device to forward them between VLANs incorrectly, resulting in system instability or a DoS.

Business Impact

This vulnerability undermines network segmentation and can lead to a complete loss of service for affected network segments. A CVSS score of 8.6 confirms a High severity level, as an attacker can disrupt network operations without requiring any valid credentials or local access.

Remediation Plan

Immediate Action: Apply the relevant Cisco IOS XE security patches immediately to address the DHCP snooping logic error.

Proactive Monitoring: Audit DHCP snooping logs and monitor for unexpected BOOTP traffic patterns originating from untrusted ports.

Compensating Controls: Disable DHCP snooping on interfaces where it is not required, or implement strict VLAN access control lists (VACLs) to limit inter-VLAN traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to trigger a DoS across VLAN boundaries makes this a high-impact flaw for enterprise environments.

Analyst Recommendation

It is strongly recommended to update Cisco IOS XE devices to a fixed release. Maintaining the integrity of DHCP snooping is vital for network security and stability; therefore, applying the primary remediation patch should be prioritized by network security teams.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure Firewall Management Center (FMC)
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An improper system process at boot time in Cisco FMC allows unauthenticated attackers to bypass authentication and execute scripts via HTTP requests to obtain root OS access.

Executive Summary:
Cisco Secure Firewall Management Center is vulnerable to an unauthenticated authentication bypass that allows remote attackers to execute scripts and gain root access to the operating system.

Vulnerability Details

CVE-ID: CVE-2026-20079

Affected Software: Cisco Secure Firewall Management Center (FMC)

Affected Versions: See vendor advisory

Vulnerability: The flaw stems from an improper system process initialized during the device boot sequence. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to the web interface, bypassing security checks to execute arbitrary commands and scripts with root privileges.

Business Impact

The impact of this vulnerability is critical, as evidenced by its CVSS score of 10.0. An attacker gaining root access to the underlying operating system can completely disable security features, steal sensitive configuration data, and maintain persistent access within the environment. This poses an existential threat to the confidentiality and availability of the managed network security infrastructure.

Remediation Plan

Immediate Action: Apply the software updates provided by Cisco for the Secure Firewall Management Center to resolve the boot-time process flaw.

Proactive Monitoring: Inspect web server logs for anomalous HTTP requests targeting system scripts and monitor for unauthorized changes to the underlying Linux operating system.

Compensating Controls: Implement strict Access Control Lists (ACLs) to ensure that only authorized administrative workstations can reach the FMC web interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation of this vulnerability. Given that this is an authentication bypass leading to root access, it is a prime target for sophisticated threat actors.

Analyst Recommendation

This vulnerability represents a complete breakdown of the device's security boundary. It is imperative that administrators treat this as a top-priority remediation task. Immediate patching is the only effective way to mitigate the risk of an unauthenticated attacker seizing control of the security management layer.

---METADATA---
VENDOR: Cisco
PRODUCT: Nexus 3600 and 9500-R Series Switches
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the EVPN Layer 2 ingress packet processing of Cisco Nexus switches allows an adjacent attacker to trigger a disruptive Layer 2 traffic loop.

Executive Summary:
Unauthenticated attackers in physical proximity to the network can cause severe network disruption by triggering Layer 2 traffic loops on Cisco Nexus switches.

Vulnerability Details

CVE-ID: CVE-2026-20051

Affected Software: Cisco Nexus 3600 and 9500-R Series Switches

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw exists in the Ethernet VPN (EVPN) Layer 2 ingress packet processing. An unauthenticated, adjacent attacker can send specially crafted packets to trigger a Layer 2 traffic loop, leading to network congestion and instability.

Business Impact

Layer 2 loops can quickly saturate network bandwidth, causing a complete loss of connectivity for affected segments. Because this attack can be performed without authentication, it poses a high risk to the availability of data center fabrics. The CVSS score of 7.4 reflects the high impact on network availability and the relative ease of exploitation from an adjacent position.

Remediation Plan

Immediate Action: Update the Cisco NX-OS software on affected Nexus 3600 and 9500-R series switches to the recommended fixed release.

Proactive Monitoring: Monitor for sudden spikes in CPU usage and unexpected increases in Layer 2 traffic patterns that may indicate a loop is occurring.

Compensating Controls: Implement port security and Layer 2 loop prevention mechanisms, such as Spanning Tree Protocol (STP) enhancements or storm control, to limit the impact of malicious packets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. This flaw requires the attacker to be on the same local network segment (adjacent).

Analyst Recommendation

This vulnerability represents a significant threat to network uptime. Organizations should apply the necessary NX-OS updates immediately and ensure that Layer 2 security best practices are enforced across the data center fabric.

---METADATA---
VENDOR: Cisco
PRODUCT: Nexus 9000 Series Fabric Switches
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A vulnerability in the SNMP subsystem of Cisco Nexus 9000 Series switches could allow an authenticated attacker to cause a denial of service condition.

Executive Summary:
Authenticated attackers can cause a total denial of service on Cisco Nexus 9000 Series switches by exploiting a flaw in the SNMP subsystem.

Vulnerability Details

CVE-ID: CVE-2026-20048

Affected Software: Cisco Nexus 9000 Series Fabric Switches

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in the Simple Network Management Protocol (SNMP) subsystem of switches operating in ACI mode. An authenticated, remote attacker can exploit this flaw to trigger a crash or reload of the device, resulting in a denial of service (DoS) condition.

Business Impact

A denial of service on core fabric switches can lead to significant network outages, disrupting data center operations and affecting all connected services. While the attacker must be authenticated, the potential for operational downtime and the high CVSS score of 7.7 make this a significant risk for enterprise networking environments.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco for the Nexus 9000 Series software to resolve the SNMP subsystem flaw.

Proactive Monitoring: Monitor SNMP traffic for unusual polling patterns and review system logs for unexpected reboots or SNMP process crashes.

Compensating Controls: Restrict SNMP access to trusted management hosts using Access Control Lists (ACLs) and use SNMPv3 with strong authentication and encryption.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 26, 2026, there is no public information indicating active exploitation of this vulnerability. Cisco has released advisories to assist customers in identifying affected software versions.

Analyst Recommendation

Network stability is critical for business continuity. Administrators should prioritize the patching of Cisco Nexus switches and ensure that SNMP access is strictly controlled to mitigate the risk of an internal DoS attack.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Cisco IOS XR Software's task group assignment allows local authenticated attackers to gain full administrative control over the device.

Executive Summary:
Flawed task group assignment for specific CLI commands in Cisco IOS XR allows local authenticated users to elevate their privileges to full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-20046

Affected Software: Cisco IOS XR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is located within the task group assignment logic for a specific CLI command. An authenticated, local attacker can exploit this logic flaw to bypass intended permission restrictions and gain unauthorized administrative rights.

Business Impact

The ability for a low-privileged user to elevate to full administrative control poses a severe threat to network security. An attacker could reconfigure the entire network backbone, disable security features, or cause prolonged service outages. The CVSS score of 8.8 underscores the critical nature of this privilege escalation, which effectively negates internal access controls.

Remediation Plan

Immediate Action: Install the latest software maintenance updates from Cisco to correct the task group assignment logic and prevent unauthorized privilege elevation.

Proactive Monitoring: Audit user task group assignments and review command execution logs for any unauthorized use of administrative-level commands by non-admin accounts.

Compensating Controls: Use external TACACS+ or RADIUS servers to strictly enforce command-level authorization and provide a centralized audit trail of all user actions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. Privilege escalation flaws are highly sought after by attackers who have already gained a foothold in a network to expand their reach.

Analyst Recommendation

Elevating privileges to administrative levels allows an attacker to bypass almost all security boundaries on the device. It is imperative that administrators apply the relevant Cisco updates immediately. Until patching is complete, perform a comprehensive review of all local user permissions and task group memberships to ensure no accounts have been granted excessive rights.

Executive Summary:
A critical vulnerability has been identified in multiple Cisco Unified Communications products, which are central to enterprise telephony and collaboration services. This flaw allows a remote attacker, without any credentials, to take complete control of an affected system, potentially leading to widespread service disruption, interception of sensitive communications, and unauthorized access to the internal network. Due to active exploitation in the wild, this vulnerability represents a significant and immediate threat to the organization.

Vulnerability Details

CVE-ID: CVE-2026-20045

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability allows for unauthenticated remote code execution. An attacker can send a specially crafted request over the network to a vulnerable device. Successful exploitation does not require any prior authentication, meaning the attacker needs no username or password. This allows the attacker to execute arbitrary commands on the underlying operating system with the privileges of the application, leading to a full system compromise.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. A successful exploit would have a severe impact on business operations. An attacker could disrupt or disable critical communication services, intercept sensitive voice and data communications, access confidential information, or use the compromised system as a beachhead to launch further attacks against the internal network. The potential consequences include significant operational downtime, regulatory fines, reputational damage, and the compromise of sensitive corporate data.

Remediation Plan

Immediate Action: The primary and most critical action is to apply the security updates provided by Cisco to all affected devices immediately. Before applying the patch, review system logs and network traffic for any signs of compromise. After patching, continue to monitor for any post-breach activity.

Proactive Monitoring: Implement enhanced monitoring for affected systems. Security teams should look for unusual network traffic patterns originating from the Cisco devices, unexpected processes or services running, unauthorized configuration changes, and suspicious command execution in system and audit logs. Utilize network intrusion detection/prevention systems (IDS/IPS) with updated signatures to detect and block exploit attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Restrict network access to the management interfaces of affected devices to a minimal set of trusted IP addresses using firewalls or access control lists (ACLs). Place the devices behind a web application firewall (WAF) or an IPS that has rules to inspect traffic for known exploit patterns.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of January 22, 2026, this vulnerability is confirmed to be actively exploited in the wild. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog underscores the high-risk nature of this flaw. The short deadline of February 10, 2026, for U.S. federal agencies to apply patches indicates that threat actors are widely and successfully leveraging this vulnerability.

Analyst Recommendation

Given the high severity, lack of authentication required for exploitation, and confirmed active attacks in the wild, this vulnerability must be treated as a critical priority. We strongly recommend that the organization initiate emergency patching procedures to apply the vendor-supplied updates to all affected Cisco products immediately. The inclusion of this CVE in the CISA KEV catalog signifies a clear and present danger; failure to remediate promptly presents an unacceptable risk of system compromise, data breach, and severe disruption to business-critical communication services.

---METADATA---
VENDOR: Cisco
PRODUCT: IOS XR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the Cisco IOS XR CLI allows local, authenticated users to execute arbitrary commands with root privileges on the underlying operating system.

Executive Summary:
An authenticated, local attacker can exploit a vulnerability in the Cisco IOS XR Command Line Interface to execute arbitrary commands with root-level privileges on the underlying operating system.

Vulnerability Details

CVE-ID: CVE-2026-20040

Affected Software: Cisco IOS XR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists in the CLI component of Cisco IOS XR Software. A local attacker with valid credentials could input specifically crafted arguments to a CLI command to bypass environment restrictions and execute system-level commands as the root user.

Business Impact

A successful exploit grants the attacker total control over the affected network device. With root access, an adversary can intercept network traffic, modify device configurations, or establish persistent backdoors, leading to a complete loss of confidentiality, integrity, and availability. The High severity rating of CVSS 8.8 reflects the significant risk of full system compromise despite the requirement for local authentication.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco for IOS XR Software immediately to patch the CLI command processing logic.

Proactive Monitoring: Review AAA (Authentication, Authorization, and Accounting) logs for unusual CLI command patterns and monitor for unauthorized changes to the underlying filesystem.

Compensating Controls: Implement the principle of least privilege by restricting CLI access to only necessary personnel and utilizing multi-factor authentication for all administrative sessions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw allowing root access, the potential for exploitation by malicious insiders or attackers with established persistence is high.

Analyst Recommendation

This vulnerability represents a significant risk to infrastructure integrity as it allows for a complete escape from the restricted CLI environment to the root operating system. Organizations should prioritize the deployment of vendor-supplied patches. In the interim, strictly audit all local account activities and limit the number of users with CLI access to the absolute minimum required for operations.

---METADATA---
VENDOR: Cisco
PRODUCT: Secure FMC Software
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The web-based management interface of Cisco Secure FMC Software is vulnerable to an authenticated SQL injection attack, allowing attackers to manipulate or extract sensitive database information.

Executive Summary:
Authenticated attackers can perform SQL injection on Cisco Secure FMC management interfaces, potentially leading to full database compromise and unauthorized administrative control.

Vulnerability Details

CVE-ID: CVE-2026-20002

Affected Software: Cisco Secure FMC Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A flaw in the web-based management interface fails to properly sanitize user-supplied input, allowing an authenticated, remote attacker to execute arbitrary SQL commands. This bypasses standard application logic to interact directly with the underlying database.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting a High-severity risk to data confidentiality and integrity. A successful SQL injection can allow an attacker to read sensitive configuration data, modify security policies, or escalate privileges within the Management Center. This could result in a total compromise of the network security management infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-supplied patches for Cisco Secure FMC immediately to address the input validation flaw.

Proactive Monitoring: Enable and review database query logs for suspicious patterns, such as unexpected "UNION" selects or unusual characters in management interface requests.

Compensating Controls: Restrict access to the FMC management interface to a dedicated, isolated management network or VPN, and enforce the principle of least privilege for all administrative accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation. However, SQL injection remains a highly effective and well-understood attack vector for gaining unauthorized access to sensitive systems.

Analyst Recommendation

Because the FMC manages critical security infrastructure, this vulnerability must be addressed with extreme urgency. Apply the necessary patches immediately and ensure that all management traffic is strictly controlled and monitored to prevent unauthorized access to the web interface.

---METADATA---
VENDOR: OSNexus
PRODUCT: QuantaStor SDS Manager
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the OSNexus QuantaStor SDS Manager login endpoint allows unauthenticated attackers to bypass authentication.

Executive Summary:
OSNexus QuantaStor SDS Manager contains a critical SQL injection vulnerability that allows unauthenticated attackers to bypass authentication and gain administrative access.

Vulnerability Details

CVE-ID: CVE-2026-10880

Affected Software: OSNexus QuantaStor SDS Manager

Affected Versions: See vendor advisory

Vulnerability: The username field in the login endpoint lacks proper sanitization, allowing an unauthenticated remote attacker to inject SQL commands and bypass password requirements to log in as an administrator.

Business Impact

With a CVSS score of 9.8, this flaw allows for full administrative compromise of the storage management interface. This could result in unauthorized access to stored data, configuration changes, or the complete destruction of storage volumes, severely impacting business continuity and data integrity.

Remediation Plan

Immediate Action: Apply the latest security updates provided by OSNexus to patch the login endpoint.

Proactive Monitoring: Monitor server logs for suspicious database query strings or multiple failed login attempts followed by successful administrative sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical because it provides an unauthenticated path to administrative privileges. Administrators should ensure the QuantaStor SDS Manager is fully patched and shielded from direct public exposure until updates are successfully applied.

Executive Summary:
A critical vulnerability has been discovered in the web services of multiple widely-used Cisco networking and security products, including firewalls and routers. This flaw allows a remote, unauthenticated attacker to potentially take complete control of an affected device. Successful exploitation could lead to a severe network breach, data theft, and significant operational disruption.

Vulnerability Details

CVE-ID: CVE-2025-20363

Affected Software: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software.

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability exists within the web services component accessible on various Cisco devices. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to the web services interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges, effectively granting them complete control over the system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.0. Exploitation could have a devastating impact on business operations, as the affected devices are often core components of an organization's network infrastructure. Potential consequences include an attacker gaining the ability to intercept or redirect network traffic, deploy malware or ransomware into the core network, cause a complete denial of service, and gain a foothold to move laterally across the internal network, compromising sensitive data and critical systems.

Remediation Plan

Immediate Action: The primary remediation is to apply security updates provided by Cisco immediately. Organizations must update all affected Cisco ASA, FTD, IOS, and IOS XE devices to a patched version as specified in the vendor's security advisory. In parallel, security teams should actively monitor for any signs of exploitation attempts and review web service access logs for anomalous activity.

Proactive Monitoring: Monitor web service access logs on affected devices for unusual or malformed requests. Implement network traffic analysis to detect anomalous outbound connections originating from the management interfaces of these devices. Security teams should be vigilant for signs of compromise, such as unexpected system reboots, configuration changes, or the creation of unauthorized user accounts.

Compensating Controls: If patching cannot be performed immediately, implement the following controls to reduce risk:

• Restrict access to the web services management interface to a dedicated, secure management network.
• Use Access Control Lists (ACLs) to block all access to the management interface from the internet and other untrusted network segments.
• If the web services interface is not essential for operations, disable it completely.
• Deploy Intrusion Prevention System (IPS) signatures that specifically target this vulnerability as they become available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Sep 25, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The CISA KEV status is "No". However, given the critical severity and the widespread deployment of these devices on network perimeters, it is highly probable that threat actors will reverse-engineer the patch to develop an exploit.

Analyst Recommendation

Due to the critical severity (CVSS 9.0) of this vulnerability and the foundational role these Cisco devices play in network security, immediate action is required. We strongly recommend that organizations prioritize the testing and deployment of the security patches provided by Cisco across all affected devices. While this CVE is not yet on the CISA KEV list, its high impact makes it a prime target for future exploitation. If immediate patching is not feasible, the compensating controls outlined above must be implemented without delay to significantly reduce the attack surface.

Executive Summary:
A high-severity vulnerability has been discovered in the Simple Network Management Protocol (SNMP) subsystem of widely-used Cisco networking software. An authenticated attacker with low-level privileges can remotely exploit this flaw to cause a device to crash, resulting in a Denial of Service (DoS) and a network outage. Organizations should prioritize applying security updates to prevent disruption to critical network infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-20352

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the SNMP service of Cisco IOS and IOS XE software. A remote attacker who has successfully authenticated to an affected device with low-privilege credentials can exploit this flaw by sending a specially crafted SNMP request. The processing of this malicious request triggers an unhandled condition, leading to a crash of the SNMP process and a subsequent device reload, causing a complete Denial of Service (DoS).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.7. The primary business impact is the potential for significant network disruption. Successful exploitation will lead to a Denial of Service, causing network devices like routers and switches to become unresponsive or reboot. This can result in widespread connectivity loss for users, applications, and critical services, leading to operational downtime, productivity loss, and potential financial impact. The risk is elevated as the attacker only requires low-privilege authenticated access, which may be more common or less monitored than administrative accounts.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately. Prioritize patching for internet-facing systems and critical internal infrastructure. After patching, continue to monitor for any signs of exploitation attempts and review device and authentication logs for suspicious activity.

Proactive Monitoring: Security teams should monitor for anomalous SNMP traffic, such as an unusual volume of requests or queries from non-standard IP addresses. Monitor device logs for SNMP-related errors or repeated process crashes. Keep a close watch on CPU and memory utilization on critical devices, as abnormal spikes could indicate an attempted or successful attack.

Compensating Controls: If immediate patching is not feasible, implement the following controls to mitigate risk:

• Use Access Control Lists (ACLs) to restrict SNMP access to a limited set of trusted and authorized management workstations.
• Disable the SNMP service on any device where it is not mission-critical.
• Ensure all user accounts, including those with low privileges, have strong, unique passwords and are regularly audited.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of September 24, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given that the attack only requires authenticated access, it is likely that threat actors will develop proof-of-concept exploits.

Analyst Recommendation

This vulnerability poses a significant risk to network availability and should be addressed urgently. We recommend that organizations prioritize the deployment of vendor-supplied patches across all affected Cisco IOS and IOS XE devices. While this CVE is not currently on the CISA KEV list, its high CVSS score and the widespread deployment of affected devices make it a prime target for future exploitation. In addition to patching, organizations should implement the recommended compensating controls, particularly SNMP access restrictions, as a standard security practice to strengthen their defense-in-depth posture.

Executive Summary:
A high-severity vulnerability has been discovered in Cisco Identity Services Engine (ISE) that allows an unauthenticated, remote attacker to cause the system to restart. Successful exploitation of this vulnerability results in a denial-of-service condition, which can disrupt network access for all users who rely on ISE for authentication.

Vulnerability Details

CVE-ID: CVE-2025-20343

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the RADIUS service of Cisco Identity Services Engine (ISE), specifically in the feature that rejects RADIUS requests from clients with repeated failures. An unauthenticated, remote attacker can exploit this flaw by sending a sequence of specially crafted RADIUS requests to a vulnerable ISE node. When the system processes these repeated failed requests, an error is triggered that causes the entire ISE service to crash and restart, resulting in a temporary denial of service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. The primary business impact is a loss of availability for network access control services. As Cisco ISE is a critical component for authenticating users and devices to wired, wireless, and VPN networks, an unexpected restart will prevent legitimate users from connecting to network resources. This can lead to significant operational disruptions, loss of productivity, and an inability to enforce security policies across the network until the service is restored.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected Identity Services Engine deployments immediately. Prioritize patching for internet-facing or mission-critical ISE nodes. After patching, monitor system logs for any signs of instability or further unexpected reboots.

Proactive Monitoring: Monitor for an unusual volume of failed RADIUS authentication requests, especially from untrusted or unknown source IP addresses. System administrators should configure alerts for unexpected service restarts or crash events on ISE nodes. Review network traffic for anomalous patterns targeting RADIUS ports (UDP/1812, UDP/1813, UDP/1645, UDP/1646).

Compensating Controls: If patching cannot be performed immediately, implement strict Access Control Lists (ACLs) on network firewalls or routers to limit RADIUS traffic to ISE nodes from only known, trusted network access devices (e.g., switches, wireless controllers). This will limit the attack surface by preventing attackers on untrusted networks from reaching the vulnerable service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of November 5, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the low complexity of the attack, proof-of-concept code could be developed quickly by threat actors.

Analyst Recommendation

Given the high severity score (CVSS 8.6) and the ability for a remote, unauthenticated attacker to cause a denial-of-service, organizations are urged to treat this vulnerability with high priority. The potential for significant business disruption from the loss of network authentication services is substantial. Although CVE-2025-20343 is not currently on the CISA KEV list, its critical impact warrants immediate patching across all vulnerable Cisco ISE deployments.

Executive Summary:
A high-severity vulnerability has been identified in the Cisco Catalyst Center Virtual Appliance. This flaw could allow an attacker who already has basic access to the system to gain full Administrator-level control, potentially leading to unauthorized network changes, data exfiltration, or service disruption.

Vulnerability Details

CVE-ID: CVE-2025-20341

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A privilege escalation vulnerability exists within the Cisco Catalyst Center Virtual Appliance. The flaw is due to insufficient authorization checks for certain functions accessible via the management interface. An authenticated, remote attacker with low-level user privileges could exploit this vulnerability by sending a specially crafted request to a vulnerable API endpoint. A successful exploit would grant the attacker full Administrator privileges on the affected system, allowing them to execute arbitrary commands and gain complete control over the appliance.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. A successful exploit would result in a complete compromise of the Cisco Catalyst Center, which serves as a central point of network management and control. An attacker with Administrator privileges could reconfigure network devices, disable security policies, intercept sensitive network traffic, and gain access to otherwise protected network segments. The potential consequences include widespread network disruption, data breaches of confidential information, and a pivot point for further attacks within the internal network.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by Cisco to all affected Catalyst Center Virtual Appliances immediately. Before patching, it is recommended to take a system snapshot or backup. After patching, security teams should actively monitor for any signs of exploitation attempts and conduct a thorough review of system and access logs for any anomalous or unauthorized activity preceding the patch.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Security teams should specifically look for:

• Anomalous login patterns or successful logins from unexpected IP addresses or geolocations.
• Audit logs showing low-privilege user accounts performing administrative functions or attempting to access restricted APIs.
• Unexpected or unauthorized configuration changes to the Catalyst Center or any managed network devices.
• Outbound network traffic from the Catalyst Center appliance to suspicious or unknown external hosts.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Restrict access to the Cisco Catalyst Center management interface to a limited set of trusted IP addresses and dedicated management workstations.
• Enforce multi-factor authentication (MFA) for all user accounts, especially those with privileged access.
• Use a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) with rules to detect and block malicious requests targeting the known vulnerability.
• Implement network segmentation to limit the potential impact of a compromised appliance.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, November 14, 2025, there are no known public exploits or active exploitation attempts in the wild for this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the high CVSS score and the critical role of the affected product in network management, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Due to the high severity (CVSS 8.8) of this vulnerability and the critical function of the Cisco Catalyst Center, immediate action is required. We strongly recommend that all organizations running the affected software prioritize the deployment of vendor-supplied security updates to mitigate the risk of a full system compromise. Although this CVE is not currently listed in the CISA KEV catalog, the potential for an authenticated user to gain complete administrative control makes it a prime target for exploitation. Proactive patching and monitoring are essential to protect critical network infrastructure from this threat.

Executive Summary:
A critical vulnerability has been identified in Cisco Identity Services Engine (ISE) and related products, assigned a maximum severity score of 10.0. This flaw allows a remote attacker, without any authentication, to gain complete control over the affected system by sending a malicious request to a specific API. Successful exploitation could lead to a total compromise of the network's security and access control infrastructure, posing a severe risk to the organization.

Vulnerability Details

CVE-ID: CVE-2025-20337

Affected Software: Cisco Identity Services Engine (ISE) and Cisco Identity Services Engine-Private Cloud (ISE-PIC)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within a specific, unnamed API endpoint on the Cisco ISE and ISE-PIC platforms. An unauthenticated, remote attacker can send a specially crafted request to this vulnerable API. Due to improper input validation or a flaw in the API's logic, this request is processed in a way that allows the attacker to execute arbitrary code on the underlying operating system with the highest possible privileges (root). No user interaction or credentials are required for a successful attack.

Business Impact

Business Impact
This vulnerability is rated as critical severity with a CVSS score of 10.0, representing the highest possible risk. Cisco ISE is a foundational component of network security, responsible for enforcing access policies for users and devices. A successful exploit would grant an attacker complete control over the ISE appliance, leading to a total loss of confidentiality, integrity, and availability. An attacker could bypass all network access controls, create unauthorized administrative accounts, exfiltrate sensitive data, deploy ransomware, or use the compromised ISE appliance as a pivot point to launch further attacks across the entire network.

Remediation Plan

Immediate Action: The primary remediation is to immediately apply the security patches provided by Cisco. All instances of Cisco ISE and ISE-PIC should be upgraded to a fixed software version as outlined in the vendor's security advisory. Due to the remote and unauthenticated nature of this vulnerability, patching of internet-facing or otherwise exposed systems must be prioritized.

Proactive Monitoring: Security teams should actively monitor for signs of exploitation. Review API access logs on ISE/ISE-PIC appliances for unusual or malformed requests, especially from untrusted IP addresses. Monitor network traffic to and from the management interfaces for anomalous patterns or connections. On the appliance itself, look for unexpected processes, outbound network connections, new user accounts, or unauthorized modifications to system files and configurations.

Compensating Controls: If patching cannot be performed immediately, implement compensating controls to reduce the attack surface. Use a firewall or Access Control Lists (ACLs) to strictly limit access to the ISE/ISE-PIC management interfaces and APIs, allowing connections only from a dedicated, trusted management network. If the specific vulnerable API endpoint is identified, a Web Application Firewall (WAF) could potentially be configured with rules to block malicious requests, acting as a virtual patch.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of the publication date of this advisory (Jul 16, 2025), there is no known public proof-of-concept exploit code, and the vulnerability is not reported to be actively exploited in the wild. However, given the critical CVSS score of 10.0 and the low complexity of the attack, it is highly likely that threat actors will develop and deploy exploits rapidly. Organizations must assume that exploitation is imminent.

Analyst Recommendation

This vulnerability represents a critical and immediate threat to the security of the network. We strongly recommend that organizations treat this as an emergency and apply the vendor-supplied patches to all affected Cisco ISE and ISE-PIC systems without delay. Although this CVE is not currently on the CISA KEV list, its characteristics (unauthenticated RCE, CVSS 10.0) make it a prime candidate for future inclusion. Prioritize patching, verify system integrity, and implement the recommended monitoring and compensating controls to protect against this severe threat.

Executive Summary:
A critical vulnerability has been identified in multiple Cisco products running IOS XE software. This flaw allows a remote attacker to bypass security measures and execute commands with the highest system privileges, potentially leading to a complete takeover of affected network devices. Successful exploitation could result in significant network disruption, data theft, and unauthorized access to internal corporate networks.

Vulnerability Details

CVE-ID: CVE-2025-20334

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the HTTP API subsystem of Cisco IOS XE. An attacker can send a specially crafted HTTP request to a vulnerable device's API endpoint. Due to insufficient input validation, this request can inject malicious commands directly into the underlying operating system, which are then executed with root-level privileges. This is a remote code execution (RCE) vulnerability that does not require the attacker to be authenticated to the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant threat to business operations. A successful exploit grants an attacker complete control over the network device, allowing them to intercept or redirect traffic, exfiltrate sensitive data, disable network services, or use the compromised device as a foothold to launch further attacks against the internal network. The potential consequences include major operational downtime, regulatory fines from data breaches, loss of customer trust, and substantial financial and reputational damage.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by Cisco immediately. System administrators should prioritize patching internet-facing devices and critical internal infrastructure first. Following patching, review system and access logs for any unusual activity or connections to the HTTP API that may indicate a past or ongoing compromise.

Proactive Monitoring: Implement enhanced monitoring of network traffic to and from the management interfaces of Cisco IOS XE devices. Specifically, look for anomalous or malformed HTTP requests in web server and API logs. Monitor for unexpected outbound connections from the devices, unauthorized configuration changes, or the creation of new, unrecognized user accounts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Restrict access to the HTTP API interface to a dedicated and trusted management network. If the interface must be exposed, use strict Access Control Lists (ACLs) or firewall rules to limit access to only authorized IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 24, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the high severity and the widespread deployment of affected Cisco devices, it is highly probable that threat actors and security researchers will develop proof-of-concept exploits in the near future. Organizations should assume this vulnerability will be actively exploited soon.

Analyst Recommendation
Given the critical nature of this remote command execution vulnerability (CVSS 8.8), immediate action is required. We strongly recommend that all affected Cisco IOS XE devices be patched on an emergency basis, prioritizing those exposed to the internet. Although this vulnerability is not currently on the CISA KEV list, its severity makes it a prime candidate for future inclusion and a high-value target for attackers. Organizations that cannot patch immediately must apply the suggested compensating controls and maintain a state of heightened vigilance, actively monitoring for any indicators of compromise.

Executive Summary:
A high-severity vulnerability has been identified in the web-based user interface of multiple Cisco products. An authenticated attacker with low-level privileges can remotely exploit this flaw to cause a denial of service, potentially crashing the device and leading to a network outage. Organizations should prioritize applying security updates to prevent disruption to critical network infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-20327

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the web UI component of Cisco IOS Software. A remote attacker who has successfully authenticated to the device, even with low-level user privileges, can exploit this flaw by sending a specially crafted request to the web UI. This action triggers an unhandled condition, causing the device to crash or become unresponsive, resulting in a denial of service (DoS).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.7. Successful exploitation would result in a denial of service condition, making the affected network device unavailable. This can lead to significant business disruption, including network outages, loss of connectivity for critical services and users, and potential revenue loss. The primary risk is the interruption of business operations that rely on the availability of the network infrastructure managed by the affected Cisco devices.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately. Before patching, review access logs for the web UI to identify any unusual or suspicious activity that could indicate previous exploitation attempts.

Proactive Monitoring: Monitor device logs for abnormal reloads or crashes. System administrators should also monitor web UI access logs for anomalous patterns, such as repeated requests from a single source or access from unauthorized IP addresses. Configure network monitoring tools to alert on high CPU or memory utilization on affected devices, which could be an indicator of an ongoing attack.

Compensating Controls: If patching cannot be performed immediately, implement compensating controls to reduce the attack surface. Restrict access to the device's web UI using access control lists (ACLs) to only allow connections from trusted administrative networks or workstations. If the web UI is not essential for operations, consider disabling the HTTP/HTTPS server feature on the device and rely on CLI access via SSH for management.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the published date, September 24, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the High severity rating (CVSS 7.7) and the potential for significant operational disruption, we strongly recommend that all affected Cisco devices be patched on an expedited basis. While the vulnerability requires authentication and is not yet on the CISA KEV list, the low privilege requirement makes it a tangible threat from insiders or attackers who have compromised a low-level account. Organizations should prioritize this remediation and implement the suggested compensating controls if patching is delayed.

Executive Summary:
A high-severity vulnerability exists in the management interface of multiple Cisco products that could allow a remote attacker to redirect users to a malicious website. This could be used to trick administrators into revealing sensitive credentials or downloading malware, leveraging the user's trust in the legitimate Cisco management portal. Successful exploitation could lead to unauthorized access to critical infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-20317

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is an open redirect flaw within the Virtual Keyboard Video Monitor (vKVM) connection handling function of the Cisco Integrated Management Controller (IMC). An unauthenticated, remote attacker can exploit this by crafting a special URL that points to the vulnerable Cisco IMC interface. When a legitimate user, such as an administrator, clicks this malicious link, the IMC service improperly validates the connection parameters and automatically redirects the user's browser to an attacker-controlled website. This malicious site could be a convincing phishing page designed to steal credentials or a platform for delivering malware to the administrator's workstation.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.1. The primary business impact stems from the risk of targeted phishing campaigns against privileged users who manage Cisco infrastructure. If an administrator's credentials are stolen through a fake login page, an attacker could gain full administrative access to servers and other network devices managed by the IMC. This could lead to data breaches, system downtime, unauthorized configuration changes, and a stepping stone for lateral movement across the corporate network. The attack leverages the trust users have in the Cisco brand and interface, increasing the likelihood of a successful phishing attempt.

Remediation Plan

Immediate Action:

• Identify all vulnerable Cisco products with the Integrated Management Controller (IMC) interface within the environment.
• Apply the security updates provided by Cisco immediately to patch the vulnerability.
• After patching, review web access logs for the IMC interface for any signs of exploitation attempts that may have occurred prior to remediation.

Proactive Monitoring:

• Monitor web server and access logs for the Cisco IMC interface for unusual HTTP GET requests, particularly those involving the vKVM feature that contain external URLs in the parameters.
• Analyze network traffic for unexpected outbound connections from administrator workstations immediately following a session with the IMC interface.
• Implement alerting for multiple failed login attempts on the IMC, which could indicate a post-exploitation activity after credential theft.

Compensating Controls:

• Restrict network access to the Cisco IMC management interface. Ensure it is only accessible from a secure, isolated management network or specific, trusted IP addresses.
• Implement a Web Application Firewall (WAF) with rules to detect and block common open redirect patterns.
• Conduct user awareness training for administrators, specifically highlighting the risk of phishing attacks originating from links that appear to be for internal management tools. Advise them to navigate to the IMC interface directly rather than clicking on links.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 27, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, open redirect vulnerabilities are relatively simple to exploit and are commonly integrated into phishing kits. Threat actors may develop exploits quickly to target organizations that are slow to patch.

Analyst Recommendation

Given the High severity rating and the direct risk to privileged administrator accounts, this vulnerability poses a significant threat. It is strongly recommended that organizations prioritize the immediate deployment of vendor-supplied security updates to all affected Cisco products. Although this CVE is not currently on the CISA KEV list, its potential as a gateway for credential harvesting and malware delivery warrants urgent attention. Until patching is complete, organizations must implement compensating controls, such as network segmentation for management interfaces, and enhance monitoring to detect and block potential exploitation attempts.

Executive Summary:
A high-severity vulnerability has been discovered in the software of multiple Cisco networking products. An unauthenticated attacker from a remote location can exploit this flaw to crash an affected device by sending specific network traffic, causing a network outage and a denial of service (DoS) that could disrupt critical business operations.

Vulnerability Details

CVE-ID: CVE-2025-20315

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software. An unauthenticated, remote attacker can exploit this flaw by sending specially crafted network packets to a vulnerable device. The NBAR engine fails to properly process these packets, leading to a system exception that triggers a complete device reload, resulting in a denial of service condition.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. Successful exploitation would result in a denial of service, causing an outage of network services transiting through the affected device. This could lead to a significant disruption of business operations, loss of connectivity for users and applications, financial losses due to downtime, and potential reputational damage. The fact that the vulnerability can be exploited by an unauthenticated remote attacker significantly increases the risk, as it lowers the barrier for potential attackers.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates to all affected Cisco IOS XE devices immediately. Prioritize patching for internet-facing systems and devices that support critical infrastructure. Before patching, ensure that current device configurations are backed up.

Proactive Monitoring: Monitor system logs for unexpected device reloads, crash reports, or error messages related to the NBAR process. Analyze network traffic patterns for anomalies or malformed packets targeting the affected devices. Review access logs for unusual connection attempts, which may indicate reconnaissance activity.

Compensating Controls: If patching cannot be performed immediately, implement strict access control lists (ACLs) to limit traffic to the affected devices from only trusted IP addresses. If the NBAR feature is not a business requirement on a specific device, consider temporarily disabling it as a mitigating measure. Deploy an Intrusion Prevention System (IPS) with signatures capable of detecting and blocking traffic designed to exploit this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 24, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the low attack complexity and the widespread deployment of affected Cisco devices, the likelihood of exploit development is high. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

This vulnerability represents a high risk to the organization due to its potential to cause a significant network disruption through a denial of service. The attack can be carried out remotely by an unauthenticated attacker, making any vulnerable, network-accessible device a potential target. It is strongly recommended that the organization prioritizes the immediate application of vendor-provided security patches to all affected Cisco IOS XE devices. Until patching is complete, apply the suggested compensating controls, such as access control lists, to limit the attack surface and reduce risk.

Executive Summary:
A high-severity vulnerability has been discovered in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software. An authenticated, remote attacker could exploit this flaw to trigger a denial of service (DoS), causing the affected network device to become unresponsive or reload, leading to significant network disruption.

Vulnerability Details

CVE-ID: CVE-2025-20312

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the processing of SNMP requests in Cisco IOS XE Software. An attacker who has valid credentials for the SNMP service on a target device can send a specially crafted SNMP packet. Due to improper handling of this packet, the SNMP process can crash or cause the entire device to reload, resulting in a denial of service condition that would impact all network traffic transiting the device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.7. Successful exploitation would result in a denial of service, leading to a complete outage of the affected network device. The business impact could be severe, including interruption of critical business operations, loss of network connectivity for users and applications, and potential financial and reputational damage due to service downtime. The requirement for authentication lowers the risk slightly, but any organization using SNMP for network management could be at risk if credentials are weak or have been compromised.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately. Prioritize patching for internet-facing devices and critical internal infrastructure. After patching, continue to monitor devices for any signs of compromise or instability.

Proactive Monitoring: System administrators should monitor for indicators of exploitation attempts. This includes reviewing device logs for unexpected reloads or SNMP process crashes, analyzing network traffic for unusual or malformed SNMP queries, and monitoring device CPU and memory utilization for abnormal spikes. SNMP access logs should be reviewed for suspicious or unauthorized authentication attempts from unknown IP addresses.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk of exploitation:

• Restrict SNMP access to a dedicated, trusted management network using Access Control Lists (ACLs).
• Ensure strong, non-default SNMP community strings are used for SNMPv1/v2c or robust user credentials and encryption for SNMPv3.
• Disable the SNMP service on devices where it is not essential for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 24, 2025, there are no known public exploits or active exploitation of this vulnerability in the wild. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the widespread deployment of Cisco IOS XE, the security community may develop proof-of-concept exploits in the near future.

Analyst Recommendation

Given the high CVSS score and the potential for significant operational disruption, it is strongly recommended that organizations prioritize the patching of this vulnerability. While there is no current evidence of active exploitation, the risk of a network-wide outage justifies immediate action. Organizations should identify all vulnerable devices in their environment and deploy the vendor-supplied patches according to their risk management framework. In the interim, the implementation of compensating controls, particularly restricting SNMP access via ACLs, is a critical step to mitigate immediate risk.

Executive Summary:
A high-severity vulnerability has been discovered in certain Cisco Catalyst 9000 series switches that could allow a local attacker to cause a network outage. An attacker on the same physical network could send specific network traffic that blocks a switch port, causing it to drop all outgoing data and disrupting service for all connected devices.

Vulnerability Details

CVE-ID: CVE-2025-20311

Affected Software: Cisco IOS XE Software for Catalyst 9000 Series Switches

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the packet processing engine of Cisco IOS XE Software. An unauthenticated attacker located on the same local network segment (adjacent) can send a sequence of specially crafted Ethernet frames to a vulnerable switch. The software's failure to properly handle these frames can trigger a fault condition, forcing the targeted egress (outbound) port into a blocked state, which results in a persistent denial-of-service (DoS) as all outbound traffic through that port is dropped.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.4. A successful exploit would result in a denial-of-service (DoS) condition on the affected network switch port. This can lead to a complete loss of network connectivity for critical servers, workstations, or other network segments connected to that port, causing significant operational disruption. The primary business risks include extended downtime for essential services, loss of productivity, and potential financial impact depending on the services affected by the network outage.

Remediation Plan

Immediate Action: Organizations should immediately apply the security updates provided by Cisco to all affected Catalyst 9000 Series Switches. Prior to patching, system configurations should be backed up and a rollback plan should be established in accordance with change management procedures.

Proactive Monitoring: Network and security teams should monitor for anomalous port behavior on Catalyst 9000 switches, such as ports unexpectedly entering a blocked or error-disabled state. Review switch syslog messages for errors related to packet handling or port instability. Network traffic analysis may reveal attempts to send malformed frames, although this can be difficult to detect without specialized tools.

Compensating Controls: If immediate patching is not feasible, consider implementing compensating controls. Enforce strict port security features to limit the MAC addresses that can communicate on a given port. Implement Layer 2 security controls like DHCP Snooping and Dynamic ARP Inspection to limit the capabilities of an adjacent attacker. Isolate critical systems onto separate, more tightly controlled network segments to limit the blast radius of a potential attack.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of September 24, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The "adjacent attacker" requirement means the threat actor must have a foothold on the local network segment, reducing the likelihood of widespread, opportunistic attacks from the internet. However, the risk from malicious insiders or as a post-compromise tool for disruption remains significant.

Analyst Recommendation

Given the High severity rating (CVSS 7.4) and the potential for significant operational disruption through a denial-of-service attack, it is strongly recommended that organizations prioritize the immediate patching of all affected Cisco Catalyst 9000 Series Switches. While this vulnerability is not currently listed on the CISA KEV catalog, its low attack complexity for an adjacent attacker presents a considerable risk to network availability. Organizations should treat this as a high-priority vulnerability and apply the vendor-supplied updates as soon as possible to mitigate the risk of a network outage.

Executive Summary:
A critical vulnerability in Cisco Unified Communications Manager products could allow an unauthenticated, remote attacker to completely compromise affected systems.

Vulnerability Details

CVE-ID: CVE-2025-20309

Affected Software: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME)

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on the affected device. The flaw exists within the core communication services, requiring no prior access or user interaction to exploit.

Business Impact

A successful exploit of this vulnerability would result in a complete system compromise, reflected by its critical CVSS score of 10.0. This could lead to a total loss of telecommunication services, unauthorized access to sensitive call data and system configurations, and a complete breach of confidentiality, integrity, and availability for the organization's communication infrastructure.

Remediation Plan

Immediate Action:
Administrators must immediately apply the security updates provided by Cisco. Refer to the official vendor security advisory for specific patch information and installation instructions.

Proactive Monitoring:
Review system and access logs for any anomalous activity or unrecognized connection attempts targeting the Unified Communications Manager interfaces. Monitor for signs of exploitation.

Compensating Controls:
If patching cannot be immediately applied, restrict access to the management interfaces of affected systems using strict Access Control Lists (ACLs). This can limit the attack surface to trusted administrative networks.

Exploitation Status

Public Exploit Available: Not publicly known.

Analyst Notes: As of Jul 2, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of the flaw and the lack of an authentication requirement, the potential for exploitation is extremely high.

Analyst Recommendation

Given the maximum CVSS score of 10.0 and the fact that an attacker requires no authentication, this vulnerability represents an extreme and immediate risk. The potential for a complete communications system takeover necessitates urgent action. We strongly recommend that administrators prioritize the deployment of the vendor-supplied patches to all affected systems without delay.

Executive Summary:
A critical vulnerability exists in the Cisco Secure Firewall Management Center (FMC) software that allows an unauthenticated remote attacker to take complete control of the device. Successful exploitation could lead to arbitrary command execution on the system, enabling an attacker to modify firewall rules, access sensitive network data, and pivot to attack other internal resources, resulting in a full network compromise.

Vulnerability Details

CVE-ID: CVE-2025-20265

Affected Software: Cisco Secure Firewall Management Center (FMC) Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a command injection flaw within the RADIUS subsystem of the Cisco Secure Firewall Management Center. An unauthenticated, remote attacker can send a specially crafted RADIUS request to an affected device. Due to improper input validation, the malicious payload is passed directly to the underlying operating system's shell and executed with high-level privileges, granting the attacker full control over the system.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 10.0, representing the highest possible risk. A successful exploit would grant an attacker complete administrative control over the Firewall Management Center, which is a central point of network security policy and administration. The potential consequences include the ability to alter or disable firewall policies to allow malicious traffic, exfiltrate sensitive network configurations and credentials, disrupt network operations, and use the compromised FMC as a foothold to launch further attacks against the internal network. This constitutes a complete loss of confidentiality, integrity, and availability for the managed security infrastructure.

Remediation Plan

Immediate Action: Update all instances of Cisco Secure Firewall Management Center Software to the latest patched version as recommended by the vendor. Prioritize patching for systems with management interfaces exposed to the internet or untrusted networks. After patching, monitor for any potential exploitation attempts that may have occurred prior to remediation by reviewing system and access logs for unusual activity.

Proactive Monitoring: Organizations should monitor network traffic to the RADIUS service ports (UDP 1812/1813, 1645/1646) on FMC devices for anomalous or malformed packets. Review FMC system logs for any unexpected shell command executions, new processes, or unauthorized configuration changes. Implement intrusion detection system (IDS) rules that can identify and alert on common command injection payloads.

Compensating Controls: If immediate patching is not feasible, restrict network access to the FMC’s RADIUS service ports to only trusted IP addresses and dedicated management segments using an upstream firewall or access control lists (ACLs). If the RADIUS feature is not in use, consider disabling the service entirely on the device to eliminate this attack vector.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Aug 14, 2025, there are no known public exploits or active, widespread exploitation campaigns targeting this vulnerability. However, due to the critical CVSS score of 10.0 and the simplicity of exploiting command injection flaws, it is highly probable that threat actors will develop and deploy exploit code in the near future.

Analyst Recommendation

This vulnerability presents a grave and immediate risk to the organization. Given the critical CVSS score of 10.0, which allows for unauthenticated remote code execution, it is imperative that all affected Cisco Secure Firewall Management Center instances are patched immediately. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime candidate for future inclusion. Organizations must act preemptively to apply the necessary updates without delay to prevent a potential full-scale network breach.

Executive Summary:
A high-severity vulnerability has been identified in multiple Cisco products that could allow a remote attacker to shut down affected network devices. This flaw, which requires no authentication, can be exploited by sending a malicious network packet, leading to a denial-of-service (DoS) that could disrupt critical network connectivity and business operations.

Vulnerability Details

CVE-ID: CVE-2025-20253

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the handling of Internet Key Exchange version 2 (IKEv2) packets. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted IKEv2 packet to the IKEv2 listener on an affected device. Improper processing of this packet by the system leads to a memory handling error, causing the device to crash and reload, resulting in a denial-of-service condition.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. Exploitation can lead to a complete denial-of-service, causing the affected router or firewall to reboot. This would result in a network outage, disrupting all traffic passing through the device, including internet access, internal communications, and critical VPN connections. Such an outage can cause significant business disruption, loss of productivity, and impact to service availability for customers.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately, prioritizing internet-facing systems. After patching, monitor systems for stability and review access logs for any anomalous IKEv2 connection attempts that occurred prior to the update.

Proactive Monitoring: Security teams should monitor network traffic for malformed or unusual IKEv2 packets. Review device logs for messages related to IKEv2 processing errors or unexpected system reloads. Configure alerts for system crash events to enable rapid detection of potential exploitation attempts.

Compensating Controls: If patching cannot be performed immediately, implement strict Access Control Lists (ACLs) to limit IKEv2 traffic (UDP ports 500 and 4500) to trusted IP addresses and known VPN peers only. If IKEv2 is not in use, disable the feature entirely on the affected devices to remove the attack vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 14, 2025, there are no known public proof-of-concept exploits or active exploitation of this vulnerability in the wild. However, due to the low complexity of the attack and the widespread deployment of affected products, the likelihood of exploit development is high.

Analyst Recommendation

This vulnerability presents a significant risk to network availability. Given the High severity score (CVSS 8.6) and the unauthenticated, remote nature of the attack, organizations are strongly advised to treat this as a high-priority issue. The immediate application of vendor-supplied patches is the most effective course of action. If patching is delayed, compensating controls must be implemented without delay to mitigate the risk of a network-disrupting attack.

Executive Summary:
A high-severity vulnerability has been identified in widely used Cisco firewall products. This flaw allows an authenticated remote attacker to create or delete any file on the underlying system, which could lead to a complete device takeover or render it inoperable, posing a significant risk to network security and stability.

Vulnerability Details

CVE-ID: CVE-2025-20251

Affected Software: Cisco Multiple Products (Cisco Secure Firewall ASA Software and Cisco Secure Firewall FTD Software)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability exists within the Remote Access SSL VPN service of the affected software. An attacker who has successfully authenticated to the SSL VPN service can send specially crafted requests to the device. Due to improper input validation, these requests can be used to traverse the file system and create or delete arbitrary files with elevated privileges, potentially leading to a denial-of-service condition or remote code execution.

Business Impact

With a CVSS score of 8.5, this vulnerability is rated as High severity. Successful exploitation could have a severe impact on business operations. An attacker could cause a denial-of-service (DoS) by deleting critical system files, leading to network outages and business disruption. Alternatively, an attacker could create files, such as a web shell or malicious scripts, to achieve persistent remote code execution (RCE) on the firewall, compromising the network perimeter, enabling data exfiltration, and allowing lateral movement into the internal network.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) devices immediately. Before and after patching, closely monitor devices for any signs of exploitation and thoroughly review remote access and system logs for anomalous activity.

Proactive Monitoring: Implement enhanced monitoring for affected devices. Look for unusual file creation or deletion events in system logs, unexpected service restarts or system reboots, and suspicious activity from authenticated VPN user accounts that deviates from normal behavior patterns. Monitor for connections from unusual IP addresses or at odd hours.

Compensating Controls: If immediate patching is not feasible, consider implementing compensating controls. Restrict SSL VPN access to only essential personnel and trusted IP address ranges. Enforce multi-factor authentication (MFA) for all VPN connections to make it more difficult for an attacker to obtain the required authentication. If available, deploy Intrusion Prevention System (IPS) signatures that can detect and block exploit attempts against this specific vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 14, 2025, there are no known public exploits or reports of active exploitation in the wild. However, vulnerabilities in perimeter security devices like Cisco firewalls are highly attractive targets for threat actors, and proof-of-concept exploits are often developed quickly following a public disclosure.

Analyst Recommendation
Given the high severity (CVSS 8.5) and the critical role these firewall devices play in network security, we strongly recommend that the organization prioritizes the immediate deployment of vendor-supplied patches. Although the vulnerability requires an attacker to be authenticated, this pre-requisite can be met using compromised credentials. While not yet listed on the CISA KEV list, the potential for device takeover or complete network disruption warrants treating this vulnerability with the highest urgency.

Executive Summary:
A high-severity vulnerability, identified as CVE-2025-20241, exists in the IS-IS routing protocol feature of certain Cisco Nexus switches. An unauthenticated attacker on the same local network could exploit this flaw to crash the routing process, potentially forcing the entire network device to reboot. This would result in a significant network outage and a denial of service for connected systems.

Vulnerability Details

CVE-ID: CVE-2025-20241

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability lies within the IS-IS protocol implementation on Cisco NX-OS software. An unauthenticated attacker who is network-adjacent (i.e., on the same Layer 2 segment) can send a specially crafted IS-IS packet to a vulnerable device. Improper processing of this packet triggers a fault in the IS-IS process, causing it to restart. Due to the architecture of the NX-OS software on affected platforms, the crash of a critical process like IS-IS can lead to a full system reload, resulting in a complete denial of service.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.4. A successful exploit would result in a denial of service (DoS) condition by rebooting a core network switch. This can lead to widespread network outages, disrupting all business operations that rely on the affected infrastructure. The potential consequences include loss of application availability, interruption of critical services, and potential financial and reputational damage. The risk is particularly acute for organizations that use Cisco Nexus 3000 or 9000 series switches in key data center or campus network roles where high availability is paramount.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to all affected Cisco Nexus 3000 and 9000 series switches. Before patching, review change management procedures and test updates in a non-production environment if possible. After patching, monitor for any signs of exploitation attempts and review device access and system logs for anomalous activity.

Proactive Monitoring: Monitor system logs (syslog) on affected devices for any unexpected IS-IS process restarts or system reload messages. Configure network monitoring systems to generate alerts for device unavailability or routing protocol adjacency flaps, which could indicate a successful exploit. Analyze IS-IS traffic for malformed or unusual packets if deep packet inspection capabilities are available.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Apply access control lists (ACLs) to IS-IS-enabled interfaces to permit traffic only from trusted, known adjacent routers. Implement robust Layer 2 security measures, such as port security and DHCP snooping, to prevent unauthorized devices from gaining adjacent network access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date of August 27, 2025, there is no public proof-of-concept exploit code available, and there are no reports of this vulnerability being actively exploited in the wild. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the High severity rating (CVSS 7.4) and the potential for a complete network device outage, organizations are strongly advised to prioritize the patching of this vulnerability. Although there is no current evidence of active exploitation, the low attack complexity (unauthenticated, adjacent attacker) increases the likelihood that an exploit could be developed. Applying the vendor-provided security updates is the most effective way to mitigate the risk of network disruption and ensure business continuity.

Executive Summary:
A high-severity vulnerability has been identified in the TACACS+ protocol implementation within various Cisco networking products. This flaw could allow a remote, unauthenticated attacker to bypass security controls to gain unauthorized access to network devices or view sensitive information, posing a significant risk to network integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-20160

Affected Software: Cisco IOS Software and Cisco IOS XE Software

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability exists due to improper handling of TACACS+ packets within Cisco IOS and IOS XE software. An unauthenticated, remote attacker can exploit this by sending a specially crafted sequence of TACACS+ packets to an affected device. The flawed processing of these packets can cause the system to either incorrectly grant administrative access (authentication bypass) or return memory contents containing sensitive configuration data or credentials (information disclosure). The attack targets the TACACS+ service (TCP port 49) and does not require any prior access or user interaction.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could lead to a complete compromise of network infrastructure management. An attacker gaining administrative access to routers and switches could alter configurations, intercept network traffic, disable security services, and use the compromised device as a pivot point for further attacks into the corporate network. The potential exposure of sensitive data like credentials or configuration details could facilitate broader breaches. This represents a direct and severe risk to business operations, data confidentiality, and overall network security posture.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco across all affected IOS and IOS XE devices immediately. Prioritize patching for internet-facing devices and those managing critical infrastructure. After patching, review TACACS+ authentication logs for any signs of successful unauthorized access that may have occurred prior to remediation.

Proactive Monitoring: Implement continuous monitoring of TACACS+ authentication logs on both Cisco devices and the central TACACS+ server. Specifically, look for unusual volumes of authentication requests, attempts from unknown or untrusted source IP addresses, and malformed packet alerts from network intrusion detection systems (NIDS) targeting TCP port 49.

Compensating Controls: If immediate patching is not feasible, implement strict Access Control Lists (ACLs) to restrict access to the TACACS+ service to only trusted, whitelisted IP addresses, such as dedicated management servers and administrative workstations. Isolate the management plane of network devices from general user networks to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 24, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the criticality of the affected systems and the low complexity of a potential attack, it is highly likely that exploits will be developed by security researchers and threat actors.

Analyst Recommendation

Given the high CVSS score of 8.1 and the potential for a complete network infrastructure compromise by an unauthenticated attacker, this vulnerability must be treated with extreme urgency. Although there is no current evidence of active exploitation, the risk of authentication bypass on core network devices is unacceptable. We strongly recommend that the immediate remediation actions be executed on all affected assets without delay. The compensating controls outlined above should be implemented as a temporary measure until patching is complete to mitigate immediate risk.

Executive Summary:
A high-severity vulnerability exists in certain Cisco Secure Firewall products that could allow a remote, unauthenticated attacker to cause a complete denial of service. By sending specially crafted DNS traffic through an affected firewall, an attacker can trigger an unexpected device reload, leading to a network outage for all traffic passing through the device. This vulnerability presents a significant risk to network availability and business continuity.

Vulnerability Details

CVE-ID: CVE-2025-20136

Affected Software: Cisco Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the DNS inspection engine used for Network Address Translation (NAT) on Cisco Secure Firewall ASA and FTD software. An unauthenticated, remote attacker can exploit this flaw by sending a specifically crafted sequence of DNS packets through a vulnerable device that is configured to perform DNS inspection for NAT. When the vulnerable function processes these malicious packets, a flaw is triggered that causes the device to crash and reload, resulting in a denial of service (DoS) condition.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. A successful exploit would result in a complete denial of service, as the firewall device would unexpectedly reload. This would interrupt all network traffic, including internet access, VPN connections, and access to internal resources protected by the firewall. The potential consequences include significant business disruption, violation of service level agreements (SLAs), and reputational damage. Given that the attack can be launched remotely by an unauthenticated user, the risk to internet-facing firewalls is particularly high.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately. Before and after patching, actively monitor firewall logs for unexpected reloads or crashes and review access logs for any anomalous DNS traffic patterns that could indicate an exploitation attempt.

Proactive Monitoring:

• Monitor system logs (syslog) for any entries indicating unexpected device reboots, crashes, or memory-related errors associated with the DNS inspection process.
• Utilize network monitoring tools to look for unusual spikes or malformed DNS traffic from untrusted external sources.
• Configure and monitor Intrusion Detection/Prevention System (IDS/IPS) alerts for signatures related to CVE-2025-20136 as they become available.

Compensating Controls:
If immediate patching is not feasible, consider the following mitigations:

• Temporarily disable the DNS inspection feature on the affected firewall. Note that this may impact functionality that relies on DNS-based NAT translations.
• Implement an upstream access control list (ACL) on a router or other network device to block or rate-limit DNS traffic from untrusted sources before it reaches the vulnerable firewall.
• Deploy an IPS in front of the firewall with up-to-date signatures capable of detecting and blocking exploit attempts for this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of the publication date, August 14, 2025, there are no known public exploits or active attacks targeting this vulnerability. However, given the high CVSS score and the prevalence of affected Cisco devices, security researchers and threat actors are likely to develop exploit code. Organizations should assume that exploitation is imminent.

Analyst Recommendation

Given the high severity (CVSS 8.6) of this vulnerability and its potential to cause a complete network outage with no user authentication required, we strongly recommend that organizations prioritize applying the vendor-supplied patches to all affected Cisco Secure Firewall devices immediately. Although this vulnerability is not currently listed on the CISA KEV list, its critical impact on network infrastructure makes it a prime candidate for future inclusion. Proactive patching is the most effective strategy to prevent disruption to business operations.

Executive Summary:
A high-severity vulnerability has been discovered in multiple Cisco firewall products that could allow an unauthenticated attacker to remotely crash the device. Successful exploitation would result in a complete denial of service (DoS), disrupting all network traffic, including remote VPN access and internet connectivity, that is dependent on the firewall.

Vulnerability Details

CVE-ID: CVE-2025-20133

Affected Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the web server components that handle the management interface and the Remote Access SSL VPN feature. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to an affected device's web server. Processing this malicious request causes the system to crash and stop responding, leading to a complete Denial of Service (DoS) condition that requires a manual reboot to restore functionality.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.6. The primary business impact is the high likelihood of a service outage. An attacker could intentionally disrupt business operations by making the core network security appliance unavailable, thereby blocking all internet and VPN traffic. This poses a significant risk to organizations that rely on these devices for remote workforce connectivity, business-critical applications, and perimeter security, potentially leading to financial loss and reputational damage.

Remediation Plan

Immediate Action: Apply the security updates provided by Cisco to all affected devices immediately, prioritizing internet-facing systems. After patching, continue to monitor for any signs of exploitation attempts by reviewing device and network access logs for anomalous activity.

Proactive Monitoring:

• Log Analysis: Scrutinize web server access logs on affected devices for unusual or malformed requests targeting the SSL VPN or management interfaces. Monitor system logs for unexpected reboots or crash reports.
• Network Traffic Analysis: Implement monitoring to detect and alert on unusual traffic patterns or connection spikes directed at the management and VPN web servers of the firewalls.
• System Health: Configure alerts for high CPU/memory utilization or unexpected service restarts on the ASA/FTD devices, as these can be indicators of an attempted attack.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Access Control: Restrict access to the SSL VPN and device management interfaces to only trusted IP address ranges.
• Intrusion Prevention System (IPS): Deploy IPS signatures that can detect and block traffic patterns associated with attempts to exploit this vulnerability, if available.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 14, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities of this nature—unauthenticated, remote DoS on critical network infrastructure—are often targeted by threat actors shortly after disclosure. Organizations should assume that exploit code will become available and act accordingly.

Analyst Recommendation

Given the high severity (CVSS 8.6) and the unauthenticated, remote nature of this vulnerability, we strongly recommend that organizations treat this as a critical priority. The potential for a complete network outage presents a significant risk to business continuity. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion. All affected Cisco ASA and FTD devices should be patched on an emergency basis, starting with those exposed to the internet.