Cisco
Monthly
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) affecting Cisco Meraki MX security appliances, MR wireless access points, MV camera firmware, and Cisco Campus Gateway Software. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), the impact is availability-only - an unauthenticated remote attacker who can reach the affected service can trigger resource mismanagement that crashes or degrades the device, with no confidentiality or integrity loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Cisco has not published a specific patched firmware version in the CVE metadata, so administrators should consult the linked advisory to map the hardening release to their exact hardware and firmware train.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software can be crashed by an unauthenticated attacker positioned on the same Layer-2 adjacency (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) due to insufficient control flow management (CWE-691) fixed in a vendor hardening release. Exploitation is confined to attackers with an existing local foothold or wireless/physical proximity; it is not reachable from a routed or internet position, and the assessed impact is availability loss only, with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw was discovered through Cisco's internal security review rather than through exploitation reporting.
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - together with Cisco Campus Gateway Software - allows unauthenticated remote attackers to feed crafted input that the affected device fails to validate, producing a high integrity impact and a limited availability impact (C:N/I:H/A:L) under the assessed CVSS 3.1 vector. The issue is one of a set of CWE-20 weaknesses remediated in a single Cisco internal-hardening firmware release, so the specific vulnerable feature, protocol, or interface is not named and the affected version boundaries must be taken from the Cisco advisory. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); note that the 'Information Disclosure' tag does not align with the assessed vector, which shows no confidentiality impact.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software - lets an attacker positioned on an adjacent Layer 2 or wireless segment bypass authentication and reach protected functionality, with the highest impact on confidentiality. No credentials (PR:N) and no user interaction (UI:N) are required, attack complexity is low, and the Cisco-assigned score is 8.8 because the flaw crosses a security boundary (S:C); however, the attack is not routable from the internet, so real-world exposure is limited to whoever already shares a segment with the device, and no public exploit code or confirmed active exploitation was identified at time of analysis. Cisco addressed the issue in a proactive internal hardening release and published advisory cisco-sa-hardening-meraki-os-drbEX9GH, which should be used to confirm exact affected firmware versions because the advisory bundles several internally discovered issues.
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. Exploitation requires the non-default configuration of both NGOAM and SRv6 features; no public exploit was identified at time of analysis, and no CISA KEV listing exists.
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthenticated network attackers when the NGOAM (VXLAN OAM) feature is enabled. Crafted IP packets sent to a device IP interface exploit improper input validation (stack buffer overflow, CWE-121), allowing arbitrary code execution or process crashes that reload the device. No public exploit identified at time of analysis; the non-default NGOAM configuration requirement limits exposure, but this remains a high-priority vulnerability per our independent assessment.
Remote code execution in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets a network-positioned attacker who holds only low-privilege credentials inject and execute code on the appliance, resulting in complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is one of multiple internally discovered code-injection weaknesses (CWE-94) that Cisco addressed in a bundled hardening release for the product, so the specific vulnerable endpoint is not individually itemized in the advisory. There is confirmed actively exploited status neither reported nor any public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile and requirement for only an ordinary authenticated account make rapid patching of internet- or partner-reachable instances important; exploitation status is best described as no public exploit identified at time of analysis.
Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in ACI mode and managed Cisco Unified Computing System deployments - can cause an affected device to reload or otherwise become unavailable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes an unauthenticated, low-complexity, network-reachable flaw with availability-only impact and scope change, meaning the affected process can degrade resources beyond its own security boundary, but there is no confidentiality or integrity impact and no public exploit code identified at time of analysis. The issue was found during Cisco's own internal security review and is delivered as a grouped software hardening release rather than a single named feature fix, so the precise triggering traffic or configuration is not disclosed; the practical risk is loss of availability of data-center switching and fabric devices that are reachable from an untrusted network segment.
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach the NX-API listener run arbitrary code with root privileges, or crash processes hard enough to force a device reload (DoS), by sending a single crafted HTTP request. Exposure is conditional: NX-API is an optional, non-default feature, so only NX-OS devices and UCS-managed systems where it has been explicitly enabled are vulnerable to an attacker with routing access to the management/HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required once that exposure exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 severity, root-level impact, and full CIA loss make this a high-priority item for any environment exposing the NX-API management plane.
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Unified Computing System deployments - could allow a remote, unauthenticated attacker to bypass access restrictions and achieve full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was identified during a Cisco internal security review and is addressed in a NX-OS software hardening release rather than a single-point bug fix, with the advisory grouping multiple internally discovered access-control weaknesses under CVE-2026-76455. At time of analysis no public exploit code or confirmed active exploitation has been identified, and the specific vulnerable feature, protocol, or configuration mode is not disclosed in the available data, so exposure must be validated against the Cisco advisory before triage.
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote, unauthenticated attackers to cause a denial-of-service condition (process crash/restart) on affected devices. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), and exploitation is limited by reachability to the vulnerable management/control-plane service, which is often segmented on management VLANs or trusted networks. No public exploit code or confirmed active exploitation was identified in the provided data, and Cisco's advisory does not name a specific protocol, port, or feature beyond the hardening release.
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affected devices, and the same hardening advisory covers Cisco NX-OS System Software running in ACI mode as well as the NX-OS component of Cisco Unified Computing System (managed). Cisco scores it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), so the assessed impact is availability-only with a scope change and no confidentiality or integrity effect. The issue was discovered during Cisco's internal security review and is addressed by a hardening release rather than by any observed attack activity, and no public exploit code or CISA KEV entry is associated with it at time of analysis.
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
Unauthenticated remote attackers can write arbitrary files or cause a denial-of-service condition on Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) via the Cisco Smart Licensing Utility management API. The vulnerability arises from improper input validation and missing authentication, allowing crafted requests to traverse paths and modify system files or disrupt service. No public exploit code exists and exploitation has not been confirmed as active (CISA KEV); exploitation requires only network reachability to the management API.
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified Computing System (Managed) allows an authenticated attacker holding low-privilege credentials to reach high confidentiality, integrity, and availability impact against the affected device (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw surfaced during Cisco's internal security review and is remediated through a software hardening release rather than through an out-of-band emergency fix, which indicates internally discovered rather than customer-reported or externally exploited issues. There is no public exploit code and no confirmed active exploitation at time of analysis, though the network-reachable attack path and the breadth of affected platforms (standalone Nexus switches, ACI-mode fabrics, and UCS Managed systems) make it a credible operational priority despite the absence of exploitation signals.
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Unauthenticated remote attackers can reset the password of any account, including administrative users, in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) by exploiting improper authorization checks in the web-based password-reset function, leading to full application compromise. The flaw has a CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the management interface; no public exploit has been identified at time of analysis. Deployments exposing the interface to untrusted networks are at highest risk, while well-segmented instances are materially harder to attack.
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
SQL injection in Cisco Identity Services Engine (ISE) 3.1.0 through 3.5 lets an authenticated attacker with low-privileged administrative credentials read or modify data in the underlying database by sending a single crafted request to the management interface; no user interaction is required and the vector is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1). Because exploitation is gated behind valid administrative credentials, the practical exposure depends heavily on how tightly ISE management and API interfaces are restricted to trusted admin networks. Integrity impact is rated High while confidentiality is Low and availability is unaffected, so the realistic worst case is unauthorized tampering with - rather than mass exfiltration or denial of service of - ISE-stored data; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Arbitrary file disclosure in Cisco Secure Firewall Management Center (FMC) allows an authenticated, remote attacker holding only a Security Analyst (read-only) account to download arbitrary files from the affected system by sending a crafted HTTPS request to a file download API that fails to sanitize user input. The vulnerability scores CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality impact is high and the scope change indicates the flaw crosses a security boundary between the web application and the underlying appliance filesystem, while integrity and availability are unaffected. The primary limiting factor is the credential requirement - a low-privileged but valid FMC account is mandatory - and there is no indication of active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and no EPSS data was provided, making this a genuine but bounded confidentiality issue rather than a top-tier emergency.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
SQL injection in the management APIs of Cisco Identity Services Engine (ISE) allows an authenticated administrator to read arbitrary content from the backend database and to pivot into server-side request forgery (SSRF) against internal services reachable from the ISE node. The flaw stems from insufficient validation of certain API parameters that are concatenated directly into a backend SQL query, and it affects ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5.x releases enumerated by EUVD. Exploitation requires valid administrative credentials (CVSS PR:H, scope-changed S:C, confidentiality High), so this is a genuine but privilege-gated issue best treated as a post-compromise or insider-abuse vector; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Path traversal in the Cisco Identity Services Engine (ISE) REST API allows an attacker with valid administrative credentials to write files to arbitrary filesystem locations and ultimately execute commands as root on the appliance. The flaw stems from insufficient validation of file paths in upload or copy operations (CWE-23), and exploitation requires network reachability to the ISE REST API plus high-privileged credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2), so it is gated to authenticated insiders or post-compromise attackers rather than unauthenticated outsiders. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Security Approver, Access Admin, or Network Admin role to execute arbitrary SQL against the backend database, potentially exfiltrating any data and capturing session credentials of an authenticated Administrator. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity gated only by the required privileged account, and no public exploit code or active exploitation has been identified at time of analysis.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cisco Nexus Dashboard versions 2.1 through 4.2.1 contain information exposure and insecure handling vulnerabilities that allow authenticated low-privileged remote attackers to access sensitive information and potentially cause limited integrity impact. The flaws are addressed in a software hardening release and require network access to the management interface; no public exploit code exists at time of analysis. Cisco has released a patch per advisory cisco-sa-hardening-ndw1-psFvnrg.
Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Unauthenticated remote SQL injection in Cisco ISE 3.1.x through 3.5.x allows a network attacker to modify data in the product's underlying database via a crafted request, per CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The flaw is CWE-89 improper neutralization of special elements in SQL, and Cisco's advisory plus ENISA EUVD list numerous 3.1.0-3.5 patch levels as affected. No public exploit was identified at time of analysis, and no KEV signal was supplied; the assessed limiting factor is network reachability to ISE management or service interfaces.
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.
Session-token forgery in the Cisco Secure Firewall Management Center (FMC) ASDM single sign-on handler lets an unauthenticated, remote attacker authenticate as the ASDM administrator user without any credentials or user interaction, and by repeating the forgery keep legitimate administrators locked out of ASDM indefinitely. The flaw stems from improper management of the ASDM SSO token (CWE-1259, improper restriction of security token inheritance), and it affects FMC releases across the 7.0.x through 7.7.x lines as well as 10.0.x per EUVD. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the assessed impact is administrator account takeover and sustained denial of administrative access (CVSS 8.2, A:H, I:L), with the main practical barrier being network reachability to the FMC/ASDM management interface.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.
Path traversal (CWE-22) in Cisco Nexus Dashboard lets a remote attacker holding valid low-privileged credentials (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N) send crafted requests that escape intended directory boundaries, yielding high confidentiality, integrity, and availability impact for an overall base score of 8.8. Cisco addressed this and several other internally discovered flaws as a group in a single software hardening release rather than documenting each issue individually, so the specific vulnerable feature or endpoint is not publicly enumerated. No public exploit code or confirmed active exploitation was identified at time of analysis; the decisive prerequisite is an existing authenticated session, meaning fully unauthenticated internet attackers cannot exploit it directly, but any Nexus Dashboard node whose API/UI is reachable by accounts of any privilege level should be treated as in scope until patched.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. No public exploit identified at time of analysis; exploitation requires valid high-privileged administrative credentials, which sharply limits the threat despite the 9.1 CVSS score.
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Cisco Nexus Dashboard is affected by multiple SQL injection vulnerabilities (CWE-89) that can be triggered by an authenticated attacker with low privileges over the network. Successful exploitation could allow reading, modifying, or deleting sensitive data and disrupting the management interface, with high impact to confidentiality, integrity, and availability as reflected in the CVSS 3.1 score of 8.8. No public exploit identified at time of analysis, and the authentication requirement combined with typical management network segmentation limits real-world risk.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker who possesses valid user credentials on the FMC - or who can hijack an established sftunnel peer connection - can send a crafted sftunnel command that writes a malicious file to any location on the device, and that file is then executed with root privileges (CVSS 9.9, CWE-862). Authentication is required (CVSS vector PR:L), no user interaction is needed, and the sftunnel path is normally used between FMC and managed firewall devices rather than being exposed to arbitrary internet clients; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Command injection (CWE-77) in Cisco Nexus Dashboard allows a remote, authenticated attacker holding low-privilege credentials to inject and execute arbitrary commands, carrying a vendor-assigned CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact and a Scope:Changed rating. The flaw was disclosed as one of multiple issues fixed in a grouped Cisco internal 'hardening release' advisory (cisco-sa-hardening-ndw1-psFvnrg) rather than a single externally reported CVE, so specific exploit prerequisites and exact affected version boundaries should be confirmed against that advisory's fixed-release table. Authentication is the primary limiting factor - the attacker must already possess valid low-privilege credentials or a session on the management interface - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper access control in Cisco Nexus Dashboard, Cisco's data-center orchestration and management appliance, allows a network-positioned attacker who already holds a valid low-privileged account to exceed their intended permissions, with the scope-change (S:C) scoring producing full confidentiality, integrity, and availability impact. Cisco rates the flaw CVSS 9.9 (Critical) under vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; because PR:L is required, this is explicitly an authenticated flaw - a legitimate or stolen operator-level credential is a prerequisite, and it is not unauthenticated. The issue was discovered during Cisco's internal security review and shipped in a hardening release, so no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis; reachability is further limited because Nexus Dashboard is typically deployed on internal management networks rather than exposed to the internet.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attackers to access protected functionality, resulting in a CVSS 9.8 (Critical) rating with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and real-world exploitation requires network reachability to the management interface, which is typically restricted to isolated management networks. The vulnerability is part of a Cisco hardening release addressing multiple internally discovered issues; exact affected versions and functions are not specified in available data.
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
Protection-mechanism failures in Cisco Secure ASA, Cisco Secure Firewall Threat Defense, and Cisco Secure Firewall Management Center software allow an unauthenticated attacker on an adjacent network to achieve high confidentiality and integrity impact, with low availability impact, under a CVSS 9.6 vector. Cisco issued this grouped hardening CVE for multiple internally discovered CWE-693 issues; no public exploit has been identified at time of analysis and active exploitation is not confirmed. The main exposure limitation is adjacent-network access rather than internet-routable reachability, and the advisory lacks granular technical detail or a stated non-default configuration prerequisite.
Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.
Command injection in the REST API of Cisco ISE and ISE-PIC allows authenticated administrators to execute arbitrary commands with root privileges on the underlying operating system, potentially leading to complete node compromise and, in single-node deployments, a denial-of-service condition. This vulnerability (CVE-2026-20306) requires valid administrative credentials (PR:H) and network access to the management interface; no public exploit code has been identified at the time of analysis. The CVSS 3.1 base score is 9.1, driven by the high impact of root-level code execution and scope change from the web application to the OS.
Cisco ISE and ISE-PIC contain an OS command injection flaw (CWE-78) in their web-based diagnostic tools that lets an authenticated remote attacker with valid administrative credentials execute arbitrary commands and gain root on the underlying operating system. Because the attacker must already hold admin rights (PR:H), this is primarily a privilege-escalation and integrity-risk issue rather than an anonymous entry point, though the CVSS 3.1 score is 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) due to the scope change and full loss of confidentiality, integrity, and availability. On single-node deployments, successful exploitation can render the ISE node unavailable and block endpoints that have not yet authenticated from reaching the network, producing a denial-of-service condition; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain an insufficiently protected credentials vulnerability (CWE-522) that allows an authenticated, low-privilege remote attacker to recover credentials, potentially compromising ISE and, due to a scope change, other connected systems. Rated CVSS 9.9, the flaw requires network reachability and a valid low-privilege session but no user interaction. No public exploit code or active exploitation has been identified at time of analysis. Cisco has released a hardening update; consult advisory cisco-sa-hardening-ise-XU5EwX5T for fixed versions.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. A successful exploit undermines firmware integrity controls, potentially allowing persistent pre-OS implants or untrusted bootloaders on enterprise server infrastructure. No public exploit code or CISA KEV entry has been identified at time of analysis.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker with low-privilege credentials to achieve high-impact compromise of confidentiality, integrity, and availability. The vulnerabilities were discovered internally by Cisco's security engineering team during a proactive review and are addressed in a software hardening release. No public exploit or active exploitation has been identified at time of analysis, but the CVSS 8.8 score and full C:H/I:H/A:H impact profile make this a significant risk for service-provider and enterprise core-network operators running affected IOS XR releases.
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wireless access points, MV cameras, MX security appliances, or Cisco Campus Gateway Software can supply crafted input that the affected component fails to neutralize correctly, a CWE-74 injection-class condition rated CVSS 8.8 with scope change (S:C) and high confidentiality, integrity, and availability impact. Because the vector is AV:L with PR:L, the attacker must already be able to reach the device's management or local interface - exposure is tied to the management plane rather than the public internet - and the flaws were identified during a Cisco internal security review rather than through external reporting, with fixes delivered as software hardening releases described in Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the specific vulnerable feature and exact affected firmware builds are not specified in the available data.
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) affecting Cisco Meraki MX security appliances, MR wireless access points, MV camera firmware, and Cisco Campus Gateway Software. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), the impact is availability-only - an unauthenticated remote attacker who can reach the affected service can trigger resource mismanagement that crashes or degrades the device, with no confidentiality or integrity loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Cisco has not published a specific patched firmware version in the CVE metadata, so administrators should consult the linked advisory to map the hardening release to their exact hardware and firmware train.
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway software allow an unauthenticated attacker on an adjacent network segment to achieve high impact to confidentiality, integrity, and availability (CVSS 8.8). Because the vector is AV:A/AC:L/PR:N/UI:N, exploitation requires the attacker to already sit in the same Layer-2 broadcast domain, management VLAN, or directly connected segment as the target device - it is not reachable from an arbitrary internet host, and that adjacency requirement is the principal limiting factor. No public exploit identified at time of analysis, and Cisco states the issues were discovered through its own proactive internal security review rather than through exploitation, so real-world urgency is moderate despite the high base score.
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software can be crashed by an unauthenticated attacker positioned on the same Layer-2 adjacency (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) due to insufficient control flow management (CWE-691) fixed in a vendor hardening release. Exploitation is confined to attackers with an existing local foothold or wireless/physical proximity; it is not reachable from a routed or internet position, and the assessed impact is availability loss only, with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw was discovered through Cisco's internal security review rather than through exploitation reporting.
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - together with Cisco Campus Gateway Software - allows unauthenticated remote attackers to feed crafted input that the affected device fails to validate, producing a high integrity impact and a limited availability impact (C:N/I:H/A:L) under the assessed CVSS 3.1 vector. The issue is one of a set of CWE-20 weaknesses remediated in a single Cisco internal-hardening firmware release, so the specific vulnerable feature, protocol, or interface is not named and the affected version boundaries must be taken from the Cisco advisory. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); note that the 'Information Disclosure' tag does not align with the assessed vector, which shows no confidentiality impact.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software - lets an attacker positioned on an adjacent Layer 2 or wireless segment bypass authentication and reach protected functionality, with the highest impact on confidentiality. No credentials (PR:N) and no user interaction (UI:N) are required, attack complexity is low, and the Cisco-assigned score is 8.8 because the flaw crosses a security boundary (S:C); however, the attack is not routable from the internet, so real-world exposure is limited to whoever already shares a segment with the device, and no public exploit code or confirmed active exploitation was identified at time of analysis. Cisco addressed the issue in a proactive internal hardening release and published advisory cisco-sa-hardening-meraki-os-drbEX9GH, which should be used to confirm exact affected firmware versions because the advisory bundles several internally discovered issues.
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. Exploitation requires the non-default configuration of both NGOAM and SRv6 features; no public exploit was identified at time of analysis, and no CISA KEV listing exists.
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthenticated network attackers when the NGOAM (VXLAN OAM) feature is enabled. Crafted IP packets sent to a device IP interface exploit improper input validation (stack buffer overflow, CWE-121), allowing arbitrary code execution or process crashes that reload the device. No public exploit identified at time of analysis; the non-default NGOAM configuration requirement limits exposure, but this remains a high-priority vulnerability per our independent assessment.
Remote code execution in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets a network-positioned attacker who holds only low-privilege credentials inject and execute code on the appliance, resulting in complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is one of multiple internally discovered code-injection weaknesses (CWE-94) that Cisco addressed in a bundled hardening release for the product, so the specific vulnerable endpoint is not individually itemized in the advisory. There is confirmed actively exploited status neither reported nor any public exploit identified at time of analysis, but the low-complexity, no-user-interaction profile and requirement for only an ordinary authenticated account make rapid patching of internet- or partner-reachable instances important; exploitation status is best described as no public exploit identified at time of analysis.
Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in ACI mode and managed Cisco Unified Computing System deployments - can cause an affected device to reload or otherwise become unavailable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes an unauthenticated, low-complexity, network-reachable flaw with availability-only impact and scope change, meaning the affected process can degrade resources beyond its own security boundary, but there is no confidentiality or integrity impact and no public exploit code identified at time of analysis. The issue was found during Cisco's own internal security review and is delivered as a grouped software hardening release rather than a single named feature fix, so the precise triggering traffic or configuration is not disclosed; the practical risk is loss of availability of data-center switching and fabric devices that are reachable from an untrusted network segment.
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach the NX-API listener run arbitrary code with root privileges, or crash processes hard enough to force a device reload (DoS), by sending a single crafted HTTP request. Exposure is conditional: NX-API is an optional, non-default feature, so only NX-OS devices and UCS-managed systems where it has been explicitly enabled are vulnerable to an attacker with routing access to the management/HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required once that exposure exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 severity, root-level impact, and full CIA loss make this a high-priority item for any environment exposing the NX-API management plane.
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Unified Computing System deployments - could allow a remote, unauthenticated attacker to bypass access restrictions and achieve full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was identified during a Cisco internal security review and is addressed in a NX-OS software hardening release rather than a single-point bug fix, with the advisory grouping multiple internally discovered access-control weaknesses under CVE-2026-76455. At time of analysis no public exploit code or confirmed active exploitation has been identified, and the specific vulnerable feature, protocol, or configuration mode is not disclosed in the available data, so exposure must be validated against the Cisco advisory before triage.
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote, unauthenticated attackers to cause a denial-of-service condition (process crash/restart) on affected devices. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), and exploitation is limited by reachability to the vulnerable management/control-plane service, which is often segmented on management VLANs or trusted networks. No public exploit code or confirmed active exploitation was identified in the provided data, and Cisco's advisory does not name a specific protocol, port, or feature beyond the hardening release.
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affected devices, and the same hardening advisory covers Cisco NX-OS System Software running in ACI mode as well as the NX-OS component of Cisco Unified Computing System (managed). Cisco scores it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), so the assessed impact is availability-only with a scope change and no confidentiality or integrity effect. The issue was discovered during Cisco's internal security review and is addressed by a hardening release rather than by any observed attack activity, and no public exploit code or CISA KEV entry is associated with it at time of analysis.
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
Unauthenticated remote attackers can write arbitrary files or cause a denial-of-service condition on Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) via the Cisco Smart Licensing Utility management API. The vulnerability arises from improper input validation and missing authentication, allowing crafted requests to traverse paths and modify system files or disrupt service. No public exploit code exists and exploitation has not been confirmed as active (CISA KEV); exploitation requires only network reachability to the management API.
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified Computing System (Managed) allows an authenticated attacker holding low-privilege credentials to reach high confidentiality, integrity, and availability impact against the affected device (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw surfaced during Cisco's internal security review and is remediated through a software hardening release rather than through an out-of-band emergency fix, which indicates internally discovered rather than customer-reported or externally exploited issues. There is no public exploit code and no confirmed active exploitation at time of analysis, though the network-reachable attack path and the breadth of affected platforms (standalone Nexus switches, ACI-mode fabrics, and UCS Managed systems) make it a credible operational priority despite the absence of exploitation signals.
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Unauthenticated remote attackers can reset the password of any account, including administrative users, in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) by exploiting improper authorization checks in the web-based password-reset function, leading to full application compromise. The flaw has a CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the management interface; no public exploit has been identified at time of analysis. Deployments exposing the interface to untrusted networks are at highest risk, while well-segmented instances are materially harder to attack.
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
SQL injection in Cisco Identity Services Engine (ISE) 3.1.0 through 3.5 lets an authenticated attacker with low-privileged administrative credentials read or modify data in the underlying database by sending a single crafted request to the management interface; no user interaction is required and the vector is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1). Because exploitation is gated behind valid administrative credentials, the practical exposure depends heavily on how tightly ISE management and API interfaces are restricted to trusted admin networks. Integrity impact is rated High while confidentiality is Low and availability is unaffected, so the realistic worst case is unauthorized tampering with - rather than mass exfiltration or denial of service of - ISE-stored data; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Arbitrary file disclosure in Cisco Secure Firewall Management Center (FMC) allows an authenticated, remote attacker holding only a Security Analyst (read-only) account to download arbitrary files from the affected system by sending a crafted HTTPS request to a file download API that fails to sanitize user input. The vulnerability scores CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality impact is high and the scope change indicates the flaw crosses a security boundary between the web application and the underlying appliance filesystem, while integrity and availability are unaffected. The primary limiting factor is the credential requirement - a low-privileged but valid FMC account is mandatory - and there is no indication of active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and no EPSS data was provided, making this a genuine but bounded confidentiality issue rather than a top-tier emergency.
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer device and register as an sftunnel peer on Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) Software, gaining manager-role privileges equivalent to root. Because the flaw is improper TLS certificate management in the protocol itself, default configurations are affected and no authentication or user interaction is required, but the attack only succeeds if the sftunnel connection is already down or can be disrupted long enough for the crafted-certificate handshake to complete (scored CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3). No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this is a serious, high-impact, but pre-exploitation issue that should be patched on a prioritized basis, especially where the FMC/FTD management plane is not isolated on a dedicated out-of-band network.
Privilege escalation in the remote diagnostics debugger of Cisco Secure Firewall Management Center (FMC) lets an authenticated, remote user turn a valid low-privileged account into root. The flaw is a faulty privilege-level check (CWE-264) applied when a user invokes remote diagnostics, so an attacker who can log into either the web-based management interface or the REST API can enable the debugger service and have it grant them elevated rights; Cisco rates the exploitation path High complexity because it requires a multi-stage sequence rather than a single crafted request (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.5). Because the attacker must already hold valid credentials on the device (PR:L), this is an access-gated escalation and not an unauthenticated entry point; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though the scope-change impact (S:C) means a compromise of the debugger context can affect resources beyond the vulnerable component. Affected releases reported through EUVD are FMC 7.7.0, 7.7.10, 7.7.10.1, 7.7.11, 7.7.12, 10.0.0 and 10.0.1.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
SQL injection in the management APIs of Cisco Identity Services Engine (ISE) allows an authenticated administrator to read arbitrary content from the backend database and to pivot into server-side request forgery (SSRF) against internal services reachable from the ISE node. The flaw stems from insufficient validation of certain API parameters that are concatenated directly into a backend SQL query, and it affects ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5.x releases enumerated by EUVD. Exploitation requires valid administrative credentials (CVSS PR:H, scope-changed S:C, confidentiality High), so this is a genuine but privilege-gated issue best treated as a post-compromise or insider-abuse vector; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software can be triggered by an attacker who already holds high-privilege administrative credentials and who can also induce a separate user interaction, potentially yielding high confidentiality, integrity, and availability impact that crosses a security scope boundary (CVSS 8.4, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H). The affected trains span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1. Cisco addressed these issues as a grouped hardening release (CWE-710, Improper Adherence to Coding Standards) rather than a single disclosed flaw; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Path traversal in the Cisco Identity Services Engine (ISE) REST API allows an attacker with valid administrative credentials to write files to arbitrary filesystem locations and ultimately execute commands as root on the appliance. The flaw stems from insufficient validation of file paths in upload or copy operations (CWE-23), and exploitation requires network reachability to the ISE REST API plus high-privileged credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2), so it is gated to authenticated insiders or post-compromise attackers rather than unauthenticated outsiders. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileged attacker with network reachability to escalate privileges and achieve a full loss of confidentiality, integrity, and availability, with a scope change that extends the impact beyond the vulnerable component itself (CVSS 3.1 base 9.9, Critical). The issues were uncovered during Cisco's internal security review and are shipped as a grouped hardening fix rather than tied to one named feature, so no single vulnerable configuration toggle is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the very broad affected version range (ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, FMC 7.0 through 10.0.1) means unpatched appliances remain exposed to any attacker who already holds valid low-privileged credentials.
SQL injection in Cisco Secure FMC's web-based management interface allows an authenticated, remote attacker holding a Security Approver, Access Admin, or Network Admin role to execute arbitrary SQL against the backend database, potentially exfiltrating any data and capturing session credentials of an authenticated Administrator. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity gated only by the required privileged account, and no public exploit code or active exploitation has been identified at time of analysis.
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cisco Nexus Dashboard versions 2.1 through 4.2.1 contain information exposure and insecure handling vulnerabilities that allow authenticated low-privileged remote attackers to access sensitive information and potentially cause limited integrity impact. The flaws are addressed in a software hardening release and require network access to the management interface; no public exploit code exists at time of analysis. Cisco has released a patch per advisory cisco-sa-hardening-ndw1-psFvnrg.
Unauthenticated file disclosure and disk-exhaustion denial of service in Cisco Secure Firewall Management Center (FMC) let a remote attacker pull sensitive files from a critical management API that performs no authentication checks. The vendor assigns CVSS 7.5, while our independent assessment scores it higher at CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H because the same missing-authentication flaw (CWE-306) yields both confidentiality and availability impact: a single unauthenticated call can exfiltrate restricted files, and sustained repeated invocation exhausts disk until the appliance becomes unresponsive. Affected release trains span FMC 7.3.0 through 7.7.12 plus 10.0.0 and 10.0.1 (tracked as EUVD-2026-81126); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary exposure limiter is network reachability to the FMC management plane.
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
Unauthenticated remote SQL injection in Cisco ISE 3.1.x through 3.5.x allows a network attacker to modify data in the product's underlying database via a crafted request, per CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The flaw is CWE-89 improper neutralization of special elements in SQL, and Cisco's advisory plus ENISA EUVD list numerous 3.1.0-3.5 patch levels as affected. No public exploit was identified at time of analysis, and no KEV signal was supplied; the assessed limiting factor is network reachability to ISE management or service interfaces.
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.
Session-token forgery in the Cisco Secure Firewall Management Center (FMC) ASDM single sign-on handler lets an unauthenticated, remote attacker authenticate as the ASDM administrator user without any credentials or user interaction, and by repeating the forgery keep legitimate administrators locked out of ASDM indefinitely. The flaw stems from improper management of the ASDM SSO token (CWE-1259, improper restriction of security token inheritance), and it affects FMC releases across the 7.0.x through 7.7.x lines as well as 10.0.x per EUVD. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the assessed impact is administrator account takeover and sustained denial of administrative access (CVSS 8.2, A:H, I:L), with the main practical barrier being network reachability to the FMC/ASDM management interface.
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco Secure Firewall ASA, FTD, and FMC software to potentially achieve full confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerabilities were internally discovered and addressed in a Cisco hardening release; the exact affected feature is not publicly detailed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured for certificate-based IKEv2 authentication, causing an unexpected device reload and a denial-of-service condition. Exploitation requires no credentials and no user interaction; the only prerequisite is a specific configuration - IKEv2 VPN with certificate authentication enabled and the IKEv2 listener (typically UDP/500 and UDP/4500) reachable from the attacker's network, which is common on internet-facing VPN concentrators. At time of analysis there is no public exploit identified, no CISA KEV listing, and the issue is availability-only (CVSS 8.6, C:N/I:N/A:H with scope change because the process crash escalates to a full device reload); devices without IKEv2 certificate authentication are not affected.
Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.
Path traversal (CWE-22) in Cisco Nexus Dashboard lets a remote attacker holding valid low-privileged credentials (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N) send crafted requests that escape intended directory boundaries, yielding high confidentiality, integrity, and availability impact for an overall base score of 8.8. Cisco addressed this and several other internally discovered flaws as a group in a single software hardening release rather than documenting each issue individually, so the specific vulnerable feature or endpoint is not publicly enumerated. No public exploit code or confirmed active exploitation was identified at time of analysis; the decisive prerequisite is an existing authenticated session, meaning fully unauthenticated internet attackers cannot exploit it directly, but any Nexus Dashboard node whose API/UI is reachable by accounts of any privilege level should be treated as in scope until patched.
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat Defense (FTD) Software, and Secure Firewall Management Center (FMC) Software can be triggered by remote, unauthenticated attackers over the network and may result in high confidentiality, integrity, and availability impact across affected firewalls and their management plane. Cisco rates the group at CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but the vector's AC:H reflects that exploitation depends on attacker-uncontrolled conditions - reliably producing the precise malformed input that causes the miscalculation is the practical barrier, and the bundled advisory names no single feature, protocol, or configuration toggle as a prerequisite. The flaws were found during Cisco's own internal hardening review, so there is no public exploit identified at time of analysis and no CISA KEV listing; remediation is delivered through Cisco's hardening release rather than awaiting out-of-band emergency fixes.
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) and Cisco Secure Firewall Threat Defense (FTD) software lets an unauthenticated, remote attacker drive an affected appliance toward a denial-of-service condition by sending crafted TLS frames during connection setup. The exposure is broad, covering FMC and FTD builds across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains, and Cisco rates it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) while our own assessment scores the same vector with scope unchanged (S:U) as a genuine but bounded availability risk - no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so the practical barrier is deployment topology rather than exploit sophistication: an attacker must obtain network reachability to the sftunnel listener on TCP/8305, which normally lives on a restricted management or out-of-band segment shared only between an FMC and its managed FTD devices.
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. No public exploit identified at time of analysis; exploitation requires valid high-privileged administrative credentials, which sharply limits the threat despite the 9.1 CVSS score.
Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Cisco Nexus Dashboard is affected by multiple SQL injection vulnerabilities (CWE-89) that can be triggered by an authenticated attacker with low privileges over the network. Successful exploitation could allow reading, modifying, or deleting sensitive data and disrupting the management interface, with high impact to confidentiality, integrity, and availability as reflected in the CVSS 3.1 score of 8.8. No public exploit identified at time of analysis, and the authentication requirement combined with typical management network segmentation limits real-world risk.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Authenticated remote code execution as root affects Cisco Secure Firewall Management Center (FMC) software. An attacker who possesses valid user credentials on the FMC - or who can hijack an established sftunnel peer connection - can send a crafted sftunnel command that writes a malicious file to any location on the device, and that file is then executed with root privileges (CVSS 9.9, CWE-862). Authentication is required (CVSS vector PR:L), no user interaction is needed, and the sftunnel path is normally used between FMC and managed firewall devices rather than being exposed to arbitrary internet clients; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Command injection (CWE-77) in Cisco Nexus Dashboard allows a remote, authenticated attacker holding low-privilege credentials to inject and execute arbitrary commands, carrying a vendor-assigned CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact and a Scope:Changed rating. The flaw was disclosed as one of multiple issues fixed in a grouped Cisco internal 'hardening release' advisory (cisco-sa-hardening-ndw1-psFvnrg) rather than a single externally reported CVE, so specific exploit prerequisites and exact affected version boundaries should be confirmed against that advisory's fixed-release table. Authentication is the primary limiting factor - the attacker must already possess valid low-privilege credentials or a session on the management interface - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) software can let a low-privilege, authenticated remote attacker cause high-impact confidentiality, integrity, and availability effects on affected appliances, with information disclosure flagged among the affected weaknesses. Cisco scores the bundled issues 9.9 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, where the scope change (S:C) and complete C/I/A impact push the rating into critical territory despite requiring a valid low-privilege credential and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the fixes were produced through an internal hardening review rather than in response to observed attacks, so real-world urgency cannot be confirmed from the available signals.
Improper access control in Cisco Nexus Dashboard, Cisco's data-center orchestration and management appliance, allows a network-positioned attacker who already holds a valid low-privileged account to exceed their intended permissions, with the scope-change (S:C) scoring producing full confidentiality, integrity, and availability impact. Cisco rates the flaw CVSS 9.9 (Critical) under vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; because PR:L is required, this is explicitly an authenticated flaw - a legitimate or stolen operator-level credential is a prerequisite, and it is not unauthenticated. The issue was discovered during Cisco's internal security review and shipped in a hardening release, so no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis; reachability is further limited because Nexus Dashboard is typically deployed on internal management networks rather than exposed to the internet.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, and Firewall Management Center (FMC) Software allows a remote, low-privilege authenticated attacker to achieve full confidentiality, integrity, and availability impact with a scope change, per the vendor's CVSS 9.9 rating. Exploitation requires an existing low-privilege session on a reachable ASA, FTD, or FMC instance (PR:L) but no user interaction and only low attack complexity; anonymous attackers cannot trigger it directly. The advisory is a grouped hardening release covering multiple internally discovered issues, so the exact triggering feature or configuration is not disclosed; no public exploit was identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attackers to access protected functionality, resulting in a CVSS 9.8 (Critical) rating with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and real-world exploitation requires network reachability to the management interface, which is typically restricted to isolated management networks. The vulnerability is part of a Cisco hardening release addressing multiple internally discovered issues; exact affected versions and functions are not specified in available data.
Unauthenticated remote attackers who can reach the Apache JServ Protocol (AJP) connector on Cisco Secure FMC Software can impersonate a peer device and, on success, execute commands as root and take full control of the FMC REST APIs. The decisive prerequisite is that the valid sftunnel connection between Cisco Secure FMC and Cisco Secure FTD must be down, which is why the flaw carries AC:H despite a 9.0 base score (AV:N/PR:N/UI:N/S:C, C/I/A:H); a healthy, normally connected deployment is not exploitable. Per the assessed vector, no authentication or user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis. Root cause is a CWE-285 improper authorization condition created by incorrect initialization of the AJP connector's encryption parameters at boot time.
Protection-mechanism failures in Cisco Secure ASA, Cisco Secure Firewall Threat Defense, and Cisco Secure Firewall Management Center software allow an unauthenticated attacker on an adjacent network to achieve high confidentiality and integrity impact, with low availability impact, under a CVSS 9.6 vector. Cisco issued this grouped hardening CVE for multiple internally discovered CWE-693 issues; no public exploit has been identified at time of analysis and active exploitation is not confirmed. The main exposure limitation is adjacent-network access rather than internet-routable reachability, and the advisory lacks granular technical detail or a stated non-default configuration prerequisite.
Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.
Command injection in the REST API of Cisco ISE and ISE-PIC allows authenticated administrators to execute arbitrary commands with root privileges on the underlying operating system, potentially leading to complete node compromise and, in single-node deployments, a denial-of-service condition. This vulnerability (CVE-2026-20306) requires valid administrative credentials (PR:H) and network access to the management interface; no public exploit code has been identified at the time of analysis. The CVSS 3.1 base score is 9.1, driven by the high impact of root-level code execution and scope change from the web application to the OS.
Cisco ISE and ISE-PIC contain an OS command injection flaw (CWE-78) in their web-based diagnostic tools that lets an authenticated remote attacker with valid administrative credentials execute arbitrary commands and gain root on the underlying operating system. Because the attacker must already hold admin rights (PR:H), this is primarily a privilege-escalation and integrity-risk issue rather than an anonymous entry point, though the CVSS 3.1 score is 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) due to the scope change and full loss of confidentiality, integrity, and availability. On single-node deployments, successful exploitation can render the ISE node unavailable and block endpoints that have not yet authenticated from reaching the network, producing a denial-of-service condition; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain an insufficiently protected credentials vulnerability (CWE-522) that allows an authenticated, low-privilege remote attacker to recover credentials, potentially compromising ISE and, due to a scope change, other connected systems. Rated CVSS 9.9, the flaw requires network reachability and a valid low-privilege session but no user interaction. No public exploit code or active exploitation has been identified at time of analysis. Cisco has released a hardening update; consult advisory cisco-sa-hardening-ise-XU5EwX5T for fixed versions.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. A successful exploit undermines firmware integrity controls, potentially allowing persistent pre-OS implants or untrusted bootloaders on enterprise server infrastructure. No public exploit code or CISA KEV entry has been identified at time of analysis.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Improper neutralization flaws (CWE-707) in Cisco IOS XR Software allow an authenticated remote attacker with low privileges to achieve full confidentiality, integrity, and availability impact against affected devices. The vulnerabilities were identified internally by Cisco's security engineering team and addressed in a batch hardening release, reference advisory cisco-sa-hardening-iosxr-qg64NcM. No public exploit code has been identified at time of analysis, though the CVSS 8.8 score and complete C/I/A triad reflect significant potential impact in carrier and enterprise routing infrastructure.
Improper handling of exceptional conditions (CWE-703) in Cisco IOS XR Software allows an authenticated, remote attacker with low-privilege credentials to achieve high-impact compromise of confidentiality, integrity, and availability. The vulnerabilities were discovered internally by Cisco's security engineering team during a proactive review and are addressed in a software hardening release. No public exploit or active exploitation has been identified at time of analysis, but the CVSS 8.8 score and full C:H/I:H/A:H impact profile make this a significant risk for service-provider and enterprise core-network operators running affected IOS XR releases.
Improper access control in Cisco IOS XR Software allows remote unauthenticated attackers to bypass authorization restrictions and gain full compromise of affected routing platforms, per Cisco's CVSS 9.8 rating. The flaw is one of several internally discovered issues addressed in a batch of software-hardening releases from Cisco's proactive security review (advisory cisco-sa-hardening-iosxr-qg64NcM). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-supplied description is high-level boilerplate with no concrete technical detail.