Cisco

Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.

Server-Side Request Forgery (SSRF) in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows an authenticated Splunk user holding the get_talos_enrichment capability to redirect the instance's outbound authenticated management requests to an attacker-controlled server, exposing Splunk management tokens. Successful exploitation grants the attacker full control over the Splunk instance, compromising the confidentiality, integrity, and availability of all data and configurations within it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available and the CVSS score of 8.8 reflects the severity of token theft as a post-exploitation path.

Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.

Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.

Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.

Blind SQL injection in Cisco Unified Intelligence Center's web-based management interface allows an authenticated low-privilege user to extract the full contents of the internal database over the network. The flaw (CWE-89) stems from insufficient input validation in a network-accessible endpoint, confirmed by Cisco in advisory cisco-sa-cuic-sql-inject-2qbfWSm5. No active exploitation has been identified and no public exploit code is known at time of analysis.

Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.

Buffer management vulnerabilities (CWE-119) in Cisco Secure Workload enable unauthenticated remote attackers to cause a denial-of-service condition against the platform, with no confidentiality or integrity impact per Cisco's own CVSS assessment. An extremely broad range of versions from 1.x through 4.0.x are affected, spanning many years of releases, indicating this class of flaw was introduced early in the product lifecycle. No public exploit identified at time of analysis and no active exploitation confirmed; Cisco discovered these vulnerabilities internally during a proactive hardening review and issued a software hardening release.

Authentication bypass in Cisco Secure Workload (formerly Tetration) lets a remote, unauthenticated attacker circumvent access-control checks and fully compromise the platform, reflected in a maximal CVSS 3.1 base score of 10.0 with a scope change. The flaw is one of multiple improper access-control weaknesses (CWE-284) fixed in a Cisco internal software-hardening release spanning affected builds from the 1.x line through 4.0.x. It was discovered internally by Cisco engineering; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authentication bypass in Cisco Secure Workload (formerly Tetration) allows remote unauthenticated attackers to compromise integrity and availability across a security scope boundary. The flaw, one of several found during a Cisco engineering-team internal security review and grouped under CWE-287 (improper authentication), carries a maximum CVSS 10.0 score driven by network reach, no privileges, and a changed scope (S:C). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS and unauthenticated network vector make it a high-priority patch.

Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse improper input validation (CWE-20) across multiple internally discovered flaws fixed in a single hardening release. Because the CVSS scope is Changed, successful exploitation can impact components beyond the initially vulnerable one. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; it was discovered and reported internally by Cisco.

Credential exposure in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) allows a low-privileged authenticated attacker to retrieve insufficiently protected credentials and reuse them to compromise other systems or components. Disclosed by Cisco itself as part of an internal security-hardening review, the flaw carries a critical 9.9 CVSS score driven by a scope change (S:C) that lets stolen credentials extend the attacker's reach beyond the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.

External control of file system paths (CWE-73) in Cisco Crosswork Planning versions 7.0.0 through 7.2.0 allows a remote, unauthenticated attacker to influence file names or paths used by the application, yielding high integrity and availability impact with a scope change (CVSS 10.0). The flaw was discovered internally by Cisco during a proactive hardening review and disclosed as part of a bundled software hardening advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because CVSS scope is Changed and privileges required is None, successful exploitation could affect components beyond the vulnerable module without authentication.

Authentication bypass in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets remote unauthenticated attackers reach a critical function that lacks authentication (CWE-306), yielding full confidentiality, integrity, and availability compromise (CVSS 10.0). The flaw was internally discovered by Cisco during a proactive security hardening review rather than external reporting, and there is no public exploit identified at time of analysis. Because scope is changed (S:C), successful exploitation can extend impact beyond the vulnerable component to other resources it manages.

Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.

Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.

Privilege escalation and cross-tenant compromise in Cisco Secure Workload (formerly Tetration) arises from improper neutralization of special elements (CWE-74 injection class), allowing a low-privileged authenticated user to inject crafted input that breaks the application security boundary. Because the CVSS scope is changed (S:C) with full confidentiality, integrity, and availability impact, an attacker with limited access can affect components beyond their authorized scope. The issue was found internally by Cisco during a hardening review and is addressed in a consolidated software hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

SQL injection in Cisco Crosswork Planning (versions 7.0.0 through 7.2.0) lets a remote attacker inject arbitrary SQL commands, per Cisco's maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The flaw was found during an internal Cisco security-hardening review and addressed in a consolidated hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Cisco's vector indicates full compromise of confidentiality, integrity, and availability with a scope change, meaning impact may extend beyond the database component itself.

Management plane flood protection deficiency in Cisco Industrial Ethernet 1000 Series Switches enables unauthenticated remote attackers to exhaust CPU resources, rendering the device manager web GUI, SSH, and API inaccessible. All firmware branches from 1.1 through 1.9.5 are confirmed affected per EUVD-2026-62559. Critically, data-plane forwarding through the switch is explicitly unaffected - only management access is disrupted - though in OT/ICS environments this distinction matters less during incidents requiring remote intervention. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and FTD Software across a broad range of versions, enabling unauthenticated remote attackers to force an unexpected device reload and take down the firewall entirely. The Changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the VPN process itself to the entire device, disrupting all traffic passing through it. This vulnerability is confirmed actively exploited (CISA KEV), with SSVC marking it as automatable, making it a high-priority remediation target for any organization with internet-exposed ASA or FTD VPN endpoints.

Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated attacker over the network to cause high-availability impact with scope change - affecting resources beyond the directly targeted component. Discovered internally by Cisco's SD-WAN engineering team during a proactive security review and addressed in software hardening releases, this vulnerability is not confirmed as actively exploited (not in CISA KEV) and no public exploit code is known at time of analysis. The CVSS 7.7 (High) score reflects the combination of network accessibility, low authentication bar, no user interaction required, and high availability consequence with scope change.

Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.

Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials by enabling a specific debug logging level and collecting the resulting system logs. The flaw (CWE-532) spans a wide version range from RoomOS 10.x through 26.x across Cisco's entire room collaboration device portfolio. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, but the High confidentiality impact - plaintext credential disclosure - warrants prioritized patching on any device with non-administrative local accounts.

Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other security-critical data to authenticated network-accessible attackers, with CVSS 8.8 reflecting the high potential for full system compromise via stolen credentials. Affecting an extraordinarily wide version range spanning 17.2.x through 20.14.x across both the Controller and Manager components, this vulnerability was discovered internally by Cisco's engineering team - a positive signal indicating no known prior adversarial exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the SD-WAN control plane sensitivity means exposed credentials could enable broad network infrastructure takeover.

Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to abuse improper symbolic-link resolution (CWE-59) to read, overwrite, or destroy files outside intended boundaries, with a scope-changing impact that reaches beyond the vulnerable process. The flaw was found during Cisco's internal SD-WAN security review and remediated in hardening releases; it carries a CVSS 9.1 rating driven by network reach, low complexity, and high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and management-plane exposure make it a meaningful patching priority.

Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the near-maximal CVSS and the centrality of the affected controllers make this a high-priority patch.

Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated low-privileged remote attacker to read sensitive authentication material from system logs. The root cause is an incomplete encryption allowlist: specific template types are excluded from the encryption policy, resulting in sensitive values being written to logs in cleartext - accessible both on the local system and on any configured remote logging server. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but successful exploitation directly enables credential theft that can cascade into broader SD-WAN infrastructure compromise.

Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by any remote unauthenticated attacker. The CVSS scope change (S:C) reflects that the reload impacts the entire device, not just the XMCP subsystem, bringing down all services simultaneously. No public exploit or CISA KEV listing exists at time of analysis, but the zero-authentication, low-complexity attack vector - combined with Cisco's ubiquitous enterprise footprint - makes this a high-priority patching target for network operations teams.

Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.

Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network.

Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multiple improper input validation flaws (CWE-20) discovered during Cisco's internal security hardening review. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates that network-adjacent or internet-facing IOS XE devices can be crashed or rendered unavailable without any credentials or user interaction, with the changed scope (S:C) suggesting impact can extend beyond the directly targeted device to dependent network services. No public exploit code has been identified and this is not listed in CISA KEV, consistent with the internally discovered origin.

Improper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthenticated attackers to compromise the confidentiality, integrity, and availability of affected network devices, per Cisco's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical). The flaw was found during an internal Cisco security review and fixed via software hardening releases; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the disclosure is a bundled hardening advisory, the exact injection sink and affected feature/protocol are not specified, so the concrete attack surface is not confirmed from available data.

Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS processes or force full device reloads by exploiting insufficient control flow management flaws (CWE-691), with a scope-changing availability impact rated CVSS 8.6. The vulnerabilities were discovered internally by Cisco's own engineering team as part of a proactive security review and addressed through software hardening releases - no active exploitation or public proof-of-concept has been identified at time of analysis. The affected version range is exceptionally broad, spanning IOS XE 16.6.x through 26.1.x, meaning virtually every Cisco IOS XE device on networks that has not been recently patched is likely running a vulnerable version.

Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.

Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through improper control of resources across their lifetime (CWE-664), affecting an exceptionally broad version range from 16.6.x through 26.1.x. The vulnerabilities were discovered proactively by Cisco's internal security engineering team and grouped as a software hardening release, meaning patches were prepared before external threat actor awareness. No public exploit exists and the CVE is absent from CISA KEV, but the AV:N/AC:L/PR:N/UI:N CVSS profile means exploitation requires no authentication or special conditions against any network-accessible IOS XE device.

Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.

Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticated remote attacker to force an unexpected device reload by sending a specially crafted BEEP SOAP request. The CVSS 8.6 score with Changed scope (S:C) reflects that a device reload disrupts all network services downstream of the affected device, amplifying impact beyond the immediate target. No public exploit or CISA KEV listing has been identified at time of analysis, though the low-complexity, no-authentication attack vector makes this a credible automated threat against any internet- or network-exposed IOS XE device running the BEEP feature.

Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacker to execute arbitrary OS commands and escalate privileges to root on affected Cisco UCS Standalone servers. Exploitation requires only low-level credentials to the IMC web-based management interface - no local access, no user interaction. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and full system impact make it a meaningful priority for any environment with IMC exposed to internal or management networks.

Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected device to reload by sending a malformed SNMP request, disrupting all traffic transiting the device. The vulnerability spans all three SNMP protocol versions (1, 2c, and 3) and affects an exceptionally broad version range across both the 3.x, 16.x, and 17.x release trains. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-change rating (S:C) reflects that a device reload cascades into a network outage for all downstream systems dependent on the affected device.

Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.

Firewall rule inheritance bypass in Cisco Terminal Services (TS) Agent allows an authenticated remote attacker to escape their own firewall policy and operate under the network access rules of a different user account. Affected versions span TSAgent-1.0 through TSAgent-1.4.2 per EUVD-2026-53447. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network-accessible vector make it straightforward to attempt for any credentialed user in an affected deployment.

Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.

Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected collaboration endpoints and room-based video devices through improper handling of exceptional conditions (CWE-703). The issue was internally discovered by Cisco's RoomOS engineering team as part of a hardening release bundling multiple flaws under this identifier, carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and has no public exploit identified at time of analysis. Note that the CVSS vector reflects availability-only impact even though a source tag labels it 'Information Disclosure,' a discrepancy defenders should verify against the Cisco advisory.

Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over the network, disrupting availability of Cisco collaboration room endpoints. Disclosed as part of a Cisco-internal security hardening review under the CWE-664 resource-lifetime pillar, the flaw carries a 7.5 CVSS score with an availability-only impact (C:N/I:N/A:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability through improperly validated input, resulting in a high availability impact (CVSS 7.5). The flaw was internally discovered during a Cisco engineering security review and shipped in a software hardening release bundling multiple CWE-20 input-validation issues. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed in an internal-hardening release covering multiple internally discovered issues grouped under CWE-311. Because sensitive data or communications are not adequately encrypted, network-positioned attackers could intercept or expose information handled by affected devices. There is no public exploit identified at time of analysis and this CVE is not in CISA KEV; EPSS is negligible at 0.06% (0th percentile), consistent with SSVC 'Exploitation: none.' Note the published CVSS 9.8 (C:H/I:H/A:H) sits uneasily against a CWE-311/Information-Disclosure classification, which normally implies a confidentiality-centric impact.

Memory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an internal security review, are scored CVSS 9.8 and could let remote unauthenticated attackers trigger buffer-overflow conditions on Cisco video collaboration endpoints. Per the CVSS vector the flaw is network-reachable with no authentication or user interaction and yields total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed exploitation despite the critical score.

Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.

Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-level privileges to gain full control over affected collaboration endpoints, with high impact to confidentiality, integrity, and availability. The issue was discovered internally by Cisco's RoomOS engineering team during a proactive security review and is one of several access-control weaknesses grouped under CVE-2026-20150 and resolved in a single hardening release. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject arbitrary shell commands through the unsanitized machine_name configuration parameter, gaining root-level code execution on the device. The flaw lives in the start_lltd() function of the 'rc' binary and requires valid high-privilege credentials (CVSS 7.2, PR:H). Publicly available exploit code exists via a third-party IoT vulnerability write-up, but there is no confirmation of active exploitation and the EPSS probability is low (0.96%).

Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated administrator inject shell commands through the unsanitized lan_ipv6_prefixlen configuration parameter, which reaches the vulnerable sub_34984() routine in the 'rc' binary. Because injected commands run as root, an admin-level attacker gains full control of the device operating system. Publicly available exploit code exists (SSVC 'poc' plus a GitHub write-up), but there is no public evidence of active exploitation and EPSS is low at 0.96% (57th percentile).

Root-level OS command injection in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) small-business routers lets an authenticated remote attacker run arbitrary commands via the unsanitized model_name parameter in the httpd binary's save_syslog_to_file() function. Because injected commands run as root, successful exploitation yields full device takeover. Publicly available exploit code exists (SSVC exploitation status: poc) but the flaw is not listed in CISA KEV.

Root-level OS command injection in Cisco RV130, RV130W, and RV110W small-business routers lets an authenticated remote administrator inject arbitrary shell commands through the wan_hostname parameter, which is passed unsanitized into the start_bonjour() routine of the 'rc' binary. Because the 'rc' process runs as root, successful exploitation yields full command execution and complete device takeover. Publicly available exploit details exist in an IoT vulnerability write-up; there is no evidence of active exploitation (not in CISA KEV) and no EPSS score was provided.

### Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading the "UNIT CELL TRANSLATION" block of a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

### Summary A memory-safety vulnerability in Open Babel's MSI parser allowed an out-of-bounds write into the `translationVectors[]` array when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's MOPAC input parser allowed an out-of-bounds write into the `translationVectors[]` array when reading Tv (translation-vector) atoms from a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading the "FINAL POINT" block of a crafted. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write into the `translationVectors[]` array when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's MOL2 parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

### Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's CSR parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

### Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

Arbitrary file read in Cisco Catalyst Center lets an unauthenticated, remote attacker retrieve files from a restricted container by sending a crafted HTTP request that abuses insufficient input validation (path traversal, CWE-22). Rated CVSS 7.5 (confidentiality-only impact), it exposes sensitive container-side data without any credentials or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Open redirect in the browser-based Cisco Webex App allowed unauthenticated remote attackers to redirect users to attacker-controlled websites by crafting malicious URLs with manipulated parameters. The vulnerability (CWE-601) stems from improper input validation of URL parameters in HTTP requests and scores CVSS 4.3 Medium (AV:N/AC:L/PR:N/UI:R). Cisco has fully remediated this server-side with no customer action required; no public exploit or CISA KEV listing exists at time of analysis.

Privilege escalation in the Cisco Umbrella Virtual Appliance vmadmin CLI enables an authenticated local attacker holding vmadmin-level credentials to elevate access to root on the affected device. The flaw, classified as CWE-269 (Improper Privilege Management), arises because the vmadmin CLI does not adequately validate or restrict specific commands that can be leveraged as a privilege escalation path. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis; the CVSS 6.0 Medium score reflects the high-privilege prerequisite that meaningfully constrains the realistic attacker pool.

Authenticated remote OS command injection in Cisco Crosswork Network Controller's web-based management interface allows a threat actor holding valid template user credentials with write permissions to execute arbitrary commands on the underlying operating system. The flaw resides in the configuration template engine, which fails to adequately validate attacker-supplied input before processing it, enabling CWE-74 injection. Impact is bounded to filesystem areas where the template user holds write access, reducing blast radius compared to full OS compromise; however, on a network automation controller, even scoped command execution can expose sensitive network configurations and automation workflows. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.

Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated low-privileged attacker to create or overwrite any file on the underlying operating system by sending crafted HTTP requests to affected API endpoints. The vulnerability stems from insufficient validation of user-supplied input during the file upload process (CWE-22), and a successful exploit can serve as a reliable stepping stone to root-level privilege escalation on the management host. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV; however, the integrity impact combined with root escalation potential elevates real-world risk above the CVSS 6.5 Medium baseline.

Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin user to execute arbitrary commands as root by uploading a crafted file through the CLI. Cisco has observed limited real-world exploitation that resulted in unauthorized configuration changes being pushed to downstream edge devices, though the issue is not currently listed in CISA KEV and no public exploit code has been identified at time of analysis.

Server-side request forgery in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition allows remote unauthenticated attackers to write files to the underlying operating system via crafted HTTP requests, which Cisco notes can be leveraged to escalate to root. Cisco has assigned this a Critical Security Impact Rating despite the 8.6 CVSS score because of the root-escalation pathway. No public exploit identified at time of analysis, and exploitation requires the non-default WebDialer service to be enabled.

Remote File Inclusion (RFI) in Cisco Finesse enables unauthenticated remote attackers to load attacker-controlled files into an active user's browser session by exploiting insufficient validation of user-supplied HTTP request parameters. Exploitation requires social engineering an authenticated Finesse user into clicking a crafted URL referencing the affected device - no server-side authentication is needed from the attacker's perspective. A successful attack results in arbitrary JavaScript execution within the Finesse interface context (browser-based XSS-class impact) or unauthorized access to sensitive contact center information; no public exploit identified at time of analysis.

Cross-site scripting in Cisco Webex Meetings' web-based UI allowed unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by persuading them to follow a crafted malicious link. Insufficient input validation (CWE-79) in the Webex Meetings web interface is the root cause; the Changed Scope (S:C) in the CVSS vector indicates impact extends beyond the Webex application into the broader browser context, enabling session theft or browser-based data access. Cisco has fully remediated this server-side in the Webex cloud service, and no customer action is required. No public exploit code identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Command injection in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance lets an authenticated administrator upload a crafted certificate to execute arbitrary commands as root on the underlying operating system. The flaw stems from insufficient validation of user-supplied input (CWE-74) and carries a CVSS 7.2 (High) rating; the elevated impact comes from full root-level code execution despite the high-privilege precondition. No public exploit identified at time of analysis, and EPSS is very low at 0.04% (13th percentile), consistent with the CISA SSVC determination of no observed exploitation.

BGP session flapping denial-of-service in Cisco NX-OS on Nexus 3000 and 9000 Series Switches exposes data-center routing infrastructure to disruption from unauthenticated remote attackers. The flaw resides in the enforce-first-as BGP feature, where incorrect parsing of a transitive BGP attribute causes an affected switch to drop its BGP peer session and enter a flap loop upon receiving a crafted BGP UPDATE message. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the Changed scope in the CVSS vector reflects that the instability can propagate beyond the directly attacked peer, amplifying network-wide impact.

Command injection in the BrowserBot component of Cisco ThousandEyes Enterprise Agent (CWE-78) allows authenticated SaaS users with transaction test management privileges to execute arbitrary OS commands inside the BrowserBot container as the unprivileged 'node' user. Exploitation requires valid ThousandEyes SaaS credentials and the ability to manage transaction tests, scoping the realistic threat primarily to insiders and compromised privileged accounts. Cisco has already deployed a remediation server-side; no customer action is required. No public exploit code or CISA KEV listing exists at time of analysis.

Authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to invoke internal REST API endpoints and act with Site Admin privileges across tenant boundaries. The flaw carries a maximum CVSS 10.0 score with a changed scope and full CIA impact, and no public exploit has been identified at time of analysis. Successful exploitation enables reading sensitive tenant data and modifying configuration globally, making this a critical-priority issue for any organization running affected versions.

Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files via XML External Entity (XXE) injection in the web UI. The vulnerability affects the management interface with network-accessible attack vector, low complexity, and no required privileges (CVSS 8.6). Attackers can extract sensitive configuration files, credentials, and operational data from the SD-WAN management platform. EPSS data not provided; exploitation status unknown but the unauthenticated remote vector and publicly disclosed Cisco advisory elevate real-world risk for internet-exposed instances.

Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templates, allowing authenticated users with read-only permissions to extract and leverage privileged credentials to escalate their access and modify system configurations. The vulnerability affects all versions of the product and requires only network access and valid (albeit minimal) read-only credentials; successful exploitation grants attackers high-privileged administrative capability over the SD-WAN fabric.

Privilege escalation in Cisco Catalyst SD-WAN Manager allows authenticated users with read-only permissions to elevate privileges to high-privileged user level through exposure of sensitive session information in audit logs. An attacker with initial read-only access can extract high-privilege session credentials from audit logs and impersonate an administrator, bypassing intended access controls. CVSS score 5.4 (medium) reflects the requirement for initial authentication, though the ease of escalation (AC:L) and direct path to administrative capability represent significant risk in multi-tenant or shared SD-WAN deployments.

Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-WAN Manager (vManage) to obtain administrative privileges and manipulate network configurations across the entire SD-WAN fabric. This critical authentication bypass (CVSS 10.0) allows direct NETCONF access as a high-privileged internal user without any credentials. Cisco released fixes in May 2026 following discovery of this second authentication flaw after a February 2026 disclosure of a related vulnerability. No active exploitation confirmed in CISA KEV at time of analysis, though the maximum CVSS score and authentication bypass nature make this a priority patching target for SD-WAN deployments.

Insecure direct object reference (IDOR) in Cisco Slido REST API allows authenticated remote attackers to view other users' social profile data and manipulate quiz or poll results. The vulnerability requires valid authentication but no user interaction, affecting confidentiality and integrity of user data and poll integrity. Cisco has released a patched version; no public exploit code or active exploitation has been identified at the time of analysis.

Remote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to execute arbitrary code as root via crafted API requests to the web management interface. Successful exploitation enables complete device compromise. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available in provided intelligence.