Cisco
Monthly
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 12.3%.
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.8%.
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.3%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.0%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.7%.
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 53.1%.
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.9%.
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.6%.
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.7%.
Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.2%.
ImageMagick's CIP (Cisco IP Phone) encoder fails to escape input-derived data, allowing markup injection into the generated XML output when a crafted image is converted to the .cip format. Affected versions are ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32; exploitation requires that an application actually invoke the CIP coder, which is non-default and must be explicitly requested. Per the assessed vector, the impact is limited to low integrity (markup corruption of the emitted XML) with no confidentiality or availability loss, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.
OS command injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated remote attacker holding system administrator credentials to submit a crafted configuration update that is executed as root on the underlying operating system. Scored CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), the flaw is heavily constrained by its PR:H authentication prerequisite: because the attacker must already be a full administrator, the marginal capability gained is limited to shutting down or disrupting the host (availability impact only), which the assessed vector reflects with C:N/I:N/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the source data.
Authenticated SQL injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets an attacker who already holds valid administrative credentials send a crafted request that reads internal database contents normally hidden from administrative users, impacting confidentiality only. The flaw is rated CVSS 3.1 4.9 (Medium) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, confirming it is remotely reachable but gated behind high privileges, with no integrity or availability impact and no user interaction required. There is no KEV listing and no public exploit identified at time of analysis, so the realistic risk is concentrated among insiders or anyone who has obtained administrator credentials for the license management portal rather than anonymous internet attackers.
Unauthenticated remote attackers can temporarily disrupt Cisco NX-OS devices by flooding a data-plane interface with a high rate of UDP or TCP connections, exhausting resources and causing packet loss that destabilizes routing and control-plane protocols. The denial-of-service condition is availability-only and self-clears once the traffic stops, but the CVSS 3.1 score of 5.8 reflects a scope change and low availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Python sandbox escape in Cisco NX-OS allows an authenticated, local attacker with low privileges to break out of the on-box Python interpreter sandbox and run arbitrary commands on the underlying operating system with that user's privileges. The issue arises from insufficient validation of user-supplied input in specific interpreter functions, affecting NX-OS software per the vendor CPE, and requires local access plus a valid low-privilege account rather than remote or unauthenticated access. No public exploit identified at time of analysis; CVSS 4.4 reflects limited confidentiality and integrity impact, and Cisco has published advisory cisco-sa-nxos-mppe-dhKZAFgb for affected platforms and versions.
EPG contract bypass in Cisco Nexus 9000 Series Fabric Switches running ACI Mode allows an unauthenticated, remote attacker to evade configured endpoint-group segmentation by sending IPv4 or IPv6 UDP packets with DHCP source and destination ports (67/68) through the device. The flaw is an improper access-control implementation (CWE-284) rated CVSS 5.8 with scope change and low integrity impact; no public exploit identified at time of analysis. Exploitation requires ACI mode and EPG contracts in use, and the attacker must have a network path through the switch; it does not directly disclose data or cause denial of service.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Missing per-role authorization checks in the CommPilot web-based management interface of Cisco BroadWorks allow an authenticated, low-privilege remote user to alter configurations on select administrative pages via a crafted HTTP request. The issue (CVE-2026-76438, CWE-863, CVSS 6.5 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affects BroadWorks releases 21.0 through 26.0, including the 21.sp1 line and assorted RI builds, with the assessed impact limited to configuration integrity - no confidentiality or availability loss per the vector. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a routine, patch-priority access-control defect rather than an emergency: a valid low-privilege CommPilot account is a prerequisite, and BroadWorks management interfaces are normally confined to carrier or management networks.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Authenticated remote attackers holding valid administrative credentials can read sensitive data - including hashed credentials usable in follow-on attacks - from Cisco Identity Services Engine (ISE) by sending a single crafted API request that is improperly validated and reaches the backend as SQL (CWE-89). The flaw affects ISE Software across the 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5 branches at numerous patch levels; exploitation requires administrator-level privileges (PR:H) but no user interaction, and the API is network-reachable. Cisco's own CVSS of 4.9 (Medium) is a credible ceiling rather than an understatement, because the high-privilege prerequisite sharply limits who can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Remote, authenticated administrators of Cisco Identity Services Engine (ISE) can escalate from the web management interface to write access on the appliance's underlying operating system by sending a single crafted HTTP request, and Cisco confirms root is easy to reach from that primitive, making the practical outcome full device compromise. The flaw is improper restriction of resource/file names (CWE-641) in the ISE management web/API layer, reachable over the network with no user interaction but requiring valid administrative credentials (CVSS 3.1 PR:H), so it is a post-authentication escalation path rather than a pre-auth entry point. Cisco's published base score of 4.9 (Medium) understates the outcome - the vendor assigned a High Security Impact Rating for exactly this reason, and our independent assessment raises confidentiality, integrity and availability impact to High; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Command injection in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with valid administrative credentials to save configuration details containing malicious values, leading to arbitrary OS command execution as root. Affected Cisco ThousandEyes Enterprise Agent versions per EUVD include 4.0, 4.1, 4.2, 4.4.2, 4.4.3, 4.4.4, 5.0, 5.1, 5.1.2, 5.1.3, and 5.2.0, and the primary limitation is the PR:H requirement for admin access. No public exploit identified at time of analysis, and the independent assessment characterizes this as a real but low-urgency issue.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Blind SQL injection in Cisco Unified Intelligence Center's web-based management interface allows an authenticated low-privilege user to extract the full contents of the internal database over the network. The flaw (CWE-89) stems from insufficient input validation in a network-accessible endpoint, confirmed by Cisco in advisory cisco-sa-cuic-sql-inject-2qbfWSm5. No active exploitation has been identified and no public exploit code is known at time of analysis.
Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.
Management plane flood protection deficiency in Cisco Industrial Ethernet 1000 Series Switches enables unauthenticated remote attackers to exhaust CPU resources, rendering the device manager web GUI, SSH, and API inaccessible. All firmware branches from 1.1 through 1.9.5 are confirmed affected per EUVD-2026-62559. Critically, data-plane forwarding through the switch is explicitly unaffected - only management access is disrupted - though in OT/ICS environments this distinction matters less during incidents requiring remote intervention. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials by enabling a specific debug logging level and collecting the resulting system logs. The flaw (CWE-532) spans a wide version range from RoomOS 10.x through 26.x across Cisco's entire room collaboration device portfolio. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, but the High confidentiality impact - plaintext credential disclosure - warrants prioritized patching on any device with non-administrative local accounts.
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated low-privileged remote attacker to read sensitive authentication material from system logs. The root cause is an incomplete encryption allowlist: specific template types are excluded from the encryption policy, resulting in sensitive values being written to logs in cleartext - accessible both on the local system and on any configured remote logging server. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but successful exploitation directly enables credential theft that can cascade into broader SD-WAN infrastructure compromise.
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.
Firewall rule inheritance bypass in Cisco Terminal Services (TS) Agent allows an authenticated remote attacker to escape their own firewall policy and operate under the network access rules of a different user account. Affected versions span TSAgent-1.0 through TSAgent-1.4.2 per EUVD-2026-53447. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network-accessible vector make it straightforward to attempt for any credentialed user in an affected deployment.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 12.3%.
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 through 15.6 could allow an unauthenticated, remote attacker to cause an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.8%.
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and no vendor patch available.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.3%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.0%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 14.1%.
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.7%.
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 53.1%.
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.9%.
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 65.6%.
Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.7%.
Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.2%.
ImageMagick's CIP (Cisco IP Phone) encoder fails to escape input-derived data, allowing markup injection into the generated XML output when a crafted image is converted to the .cip format. Affected versions are ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32; exploitation requires that an application actually invoke the CIP coder, which is non-default and must be explicitly requested. Per the assessed vector, the impact is limited to low integrity (markup corruption of the emitted XML) with no confidentiality or availability loss, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.
OS command injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated remote attacker holding system administrator credentials to submit a crafted configuration update that is executed as root on the underlying operating system. Scored CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), the flaw is heavily constrained by its PR:H authentication prerequisite: because the attacker must already be a full administrator, the marginal capability gained is limited to shutting down or disrupting the host (availability impact only), which the assessed vector reflects with C:N/I:N/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the source data.
Authenticated SQL injection in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) lets an attacker who already holds valid administrative credentials send a crafted request that reads internal database contents normally hidden from administrative users, impacting confidentiality only. The flaw is rated CVSS 3.1 4.9 (Medium) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, confirming it is remotely reachable but gated behind high privileges, with no integrity or availability impact and no user interaction required. There is no KEV listing and no public exploit identified at time of analysis, so the realistic risk is concentrated among insiders or anyone who has obtained administrator credentials for the license management portal rather than anonymous internet attackers.
Unauthenticated remote attackers can temporarily disrupt Cisco NX-OS devices by flooding a data-plane interface with a high rate of UDP or TCP connections, exhausting resources and causing packet loss that destabilizes routing and control-plane protocols. The denial-of-service condition is availability-only and self-clears once the traffic stops, but the CVSS 3.1 score of 5.8 reflects a scope change and low availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Python sandbox escape in Cisco NX-OS allows an authenticated, local attacker with low privileges to break out of the on-box Python interpreter sandbox and run arbitrary commands on the underlying operating system with that user's privileges. The issue arises from insufficient validation of user-supplied input in specific interpreter functions, affecting NX-OS software per the vendor CPE, and requires local access plus a valid low-privilege account rather than remote or unauthenticated access. No public exploit identified at time of analysis; CVSS 4.4 reflects limited confidentiality and integrity impact, and Cisco has published advisory cisco-sa-nxos-mppe-dhKZAFgb for affected platforms and versions.
EPG contract bypass in Cisco Nexus 9000 Series Fabric Switches running ACI Mode allows an unauthenticated, remote attacker to evade configured endpoint-group segmentation by sending IPv4 or IPv6 UDP packets with DHCP source and destination ports (67/68) through the device. The flaw is an improper access-control implementation (CWE-284) rated CVSS 5.8 with scope change and low integrity impact; no public exploit identified at time of analysis. Exploitation requires ACI mode and EPG contracts in use, and the attacker must have a network path through the switch; it does not directly disclose data or cause denial of service.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
Command injection in MISP misp-modules' cisco_firesight_manager_ACL_rule_export can cause arbitrary shell commands to be embedded in generated .sh export scripts when an authenticated MISP user with event/attribute submission privileges supplies values containing a single quote, such as a crafted ip-dst or url; an analyst who executes the script unmodified runs those commands with their own privileges. The issue requires active user interaction, does not directly compromise the MISP server, but can expose Cisco fireSIGHT Manager credentials, alter ACL rules, or compromise the analyst workstation, with a secondary NameError denial-of-service when the request lacks a config key. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the independent assessment views this as a genuine but conditional risk, and the upstream patch commit 625b54908efbd6acc8343aa3370d401dd370e748 adds shlex.quote and initializes config.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Unauthenticated access control bypass in Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) software lets a remote attacker send traffic that the device's access control list is supposed to block, potentially reaching hosts on protected networks. Exploitation is conditional: the device must have an ACL configured with Object Group Search (OGS) enabled and object groups populated into group access control policies, a logic error in that population step causes the wrong policy to be applied. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV) - the practical risk is moderate and configuration-dependent rather than a critical emergency.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Missing per-role authorization checks in the CommPilot web-based management interface of Cisco BroadWorks allow an authenticated, low-privilege remote user to alter configurations on select administrative pages via a crafted HTTP request. The issue (CVE-2026-76438, CWE-863, CVSS 6.5 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affects BroadWorks releases 21.0 through 26.0, including the 21.sp1 line and assorted RI builds, with the assessed impact limited to configuration integrity - no confidentiality or availability loss per the vector. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a routine, patch-priority access-control defect rather than an emergency: a valid low-privilege CommPilot account is a prerequisite, and BroadWorks management interfaces are normally confined to carrier or management networks.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote attacker to push traffic that should be blocked through the device and reach hosts in networks the firewall is meant to protect. The defect is a logic error in how group access control policies (ACPs) are populated when the Access Control List Object Group Search (OGS) feature is enabled, so it only manifests on devices that both enable OGS and rely on group objects in their ACLs. Cisco rates it 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) with limited integrity impact and scope change, no public exploit code has been identified at time of analysis, and the configuration dependency keeps real-world exposure below the raw score for most deployments.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Authenticated remote attackers holding valid administrative credentials can read sensitive data - including hashed credentials usable in follow-on attacks - from Cisco Identity Services Engine (ISE) by sending a single crafted API request that is improperly validated and reaches the backend as SQL (CWE-89). The flaw affects ISE Software across the 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5 branches at numerous patch levels; exploitation requires administrator-level privileges (PR:H) but no user interaction, and the API is network-reachable. Cisco's own CVSS of 4.9 (Medium) is a credible ceiling rather than an understatement, because the high-privilege prerequisite sharply limits who can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Remote, authenticated administrators of Cisco Identity Services Engine (ISE) can escalate from the web management interface to write access on the appliance's underlying operating system by sending a single crafted HTTP request, and Cisco confirms root is easy to reach from that primitive, making the practical outcome full device compromise. The flaw is improper restriction of resource/file names (CWE-641) in the ISE management web/API layer, reachable over the network with no user interaction but requiring valid administrative credentials (CVSS 3.1 PR:H), so it is a post-authentication escalation path rather than a pre-auth entry point. Cisco's published base score of 4.9 (Medium) understates the outcome - the vendor assigned a High Security Impact Rating for exactly this reason, and our independent assessment raises confidentiality, integrity and availability impact to High; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Command injection in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with valid administrative credentials to save configuration details containing malicious values, leading to arbitrary OS command execution as root. Affected Cisco ThousandEyes Enterprise Agent versions per EUVD include 4.0, 4.1, 4.2, 4.4.2, 4.4.3, 4.4.4, 5.0, 5.1, 5.1.2, 5.1.3, and 5.2.0, and the primary limitation is the PR:H requirement for admin access. No public exploit identified at time of analysis, and the independent assessment characterizes this as a real but low-urgency issue.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Blind SQL injection in Cisco Unified Intelligence Center's web-based management interface allows an authenticated low-privilege user to extract the full contents of the internal database over the network. The flaw (CWE-89) stems from insufficient input validation in a network-accessible endpoint, confirmed by Cisco in advisory cisco-sa-cuic-sql-inject-2qbfWSm5. No active exploitation has been identified and no public exploit code is known at time of analysis.
Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to a device's USB port to achieve full system compromise by connecting a malicious USB device. The vulnerability spans a wide range of RoomOS versions across the 10.x, 11.x, and 26.x release families, covering the Cisco Webex Room and Board series of video collaboration endpoints. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the root-level impact (C:H/I:H) and the unattended nature of conference room hardware make this a meaningful physical security risk.
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.
Management plane flood protection deficiency in Cisco Industrial Ethernet 1000 Series Switches enables unauthenticated remote attackers to exhaust CPU resources, rendering the device manager web GUI, SSH, and API inaccessible. All firmware branches from 1.1 through 1.9.5 are confirmed affected per EUVD-2026-62559. Critically, data-plane forwarding through the switch is explicitly unaffected - only management access is disrupted - though in OT/ICS environments this distinction matters less during incidents requiring remote intervention. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials by enabling a specific debug logging level and collecting the resulting system logs. The flaw (CWE-532) spans a wide version range from RoomOS 10.x through 26.x across Cisco's entire room collaboration device portfolio. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, but the High confidentiality impact - plaintext credential disclosure - warrants prioritized patching on any device with non-administrative local accounts.
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated low-privileged remote attacker to read sensitive authentication material from system logs. The root cause is an incomplete encryption allowlist: specific template types are excluded from the encryption policy, resulting in sensitive values being written to logs in cleartext - accessible both on the local system and on any configured remote logging server. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but successful exploitation directly enables credential theft that can cascade into broader SD-WAN infrastructure compromise.
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attacker holding only low-privilege credentials to render the management interface unresponsive by sending crafted input that bypasses input validation. The vulnerability spans an exceptionally broad version footprint - from 16.9.x through the 26.x release train - making patching scope significant for organizations running Cisco enterprise routing and switching infrastructure. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, placing real-world urgency below its broad scope might suggest.
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.
Firewall rule inheritance bypass in Cisco Terminal Services (TS) Agent allows an authenticated remote attacker to escape their own firewall policy and operate under the network access rules of a different user account. Affected versions span TSAgent-1.0 through TSAgent-1.4.2 per EUVD-2026-53447. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network-accessible vector make it straightforward to attempt for any credentialed user in an affected deployment.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.