68 casos · pág. 3/4
A pen tester, Dahvid Schloss (COO of Suzu Labs), audited the network devices of a large, unnamed US pharmacy retailer and found that an internet-facing Cisco edge firewall used the enable (administrator) password "password". The password was stored as Cisco IOS type 7, a reversible encoding with a publicly known key, so he could recover i…
CERT-FR advisory CERTFR-2026-AVI-1325, published 15 October 2026, reports a vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows a remote attacker to execute arbitrary code and compromise data integrity. Cisco states that CVE-2026-76519 is actively exploited. The advisory is based on Cisco security advisory c…
The Cisco Splunk 2026 State of Observability report, published on October 20, finds that organizations are deploying AI agents faster than they can build monitoring procedures and security controls. This leaves them exposed to security threats, hallucinations and related problems. Of the 2050 ITOps and engineering respondents, 38% said th…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-14 based on evidence of active exploitation: CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the f…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-30, citing evidence of active exploitation: CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
Cisco described how its team ran the live Security Operations Center at Splunk .conf26 in Denver, protecting more than 5,145 attendees from 70 countries. The SOC used a multi-stage agentic pipeline: live telemetry feeds Splunk Enterprise Security, autonomous triage agents accelerate Tier 1 analysis, Cisco Cloud Control enforces confidence…
Cisco describes how it is adapting its Cisco Secure Development Lifecycle (CSDL), built on more than 400 software security requirements, to AI-assisted and agentic software engineering. The security bar is unchanged, but requirements become atomic, machine-readable and contextual so that engineers and AI agents can act on them directly. C…
A Cisco security blog post by Jonathan Felten argues that cryptographic failures rarely come from broken algorithms. They come from the gap between a fix being available and a fix being deployed, which he calls the "last mile of trust". He says AI-driven vulnerability discovery is widening this gap because discovery scales with compute wh…
Cisco disclosed that CVE-2026-76519, a critical (CVSS 9.8) flaw in Secure Email Gateway (SEG), has been exploited as a zero-day before a fix was available. A remote, unauthenticated attacker can write files and execute commands as root on the appliance simply by sending a malicious email. CISA added the flaw to its Known Exploited Vulnera…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. CISA describes these vulnerability types as a…
At Splunk .conf26, Cisco, Splunk and Endace ran a live Agentic Security Operations Center (SOC) built around the Splunk Enterprise Security (ES) AI Triage Agent. The agent prepared findings, with a suggested disposition, rationale and next steps, and human analysts validated the evidence and made the decisions. No threat activity or incid…
During the Splunk .conf conference, Cisco's Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) produced a previously unseen detection of Flawed AMMYY, a RAT built from leaked AMMYY source code, alongside the usual detections of Upatre, Xpiro and Quasar. Detections arrived in HTTP/HTTPS pairs with identical timestamps from …
Cisco published a vendor blog describing how SentinelOne Cloud Workload Protection (CWP) integrates with Cisco ISE, Cisco Duo and Splunk (Enterprise Security and SOAR). The aim is to turn a single runtime detection on containers, Kubernetes, VMs and serverless workloads into coordinated identity, network and SOC response. The article is p…
GreyNoise announced Project Swarm, a research initiative that opens its deception platform, the Global Observation Grid (5,000+ sensors in 80 countries, 500M+ sessions per day), to outside contributors. The stated aim is better visibility into attacks on network edge devices (firewalls, VPN gateways, routers, load balancers). These device…
A zero-day vulnerability in BeyondTrust Remote Support is being reported as the latest in a run of edge-device bugs under attack. In the same week, vulnerabilities in edge products from Ivanti, Cisco and Palo Alto Networks also came under fire. The article, which is very brief, frames BeyondTrust as joining this group and as continuing th…
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credenti…
Cisco's Agentic SOC team at Splunk .conf26 showed how retrospective packet replay can check for past zero-day exploitation. They used full line-rate packet capture from Endace, intrusion detection on Cisco Secure Firewall Threat Defense (FTD), and rule updates from Cisco Talos. The scenario was Talos releasing new rules for CVE-2026-82329…
CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK law enforcement agencies published a joint advisory on the SafePay ransomware group. The group has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 202…
A Cisco blog post by Renato Morais compares past landmark threats with the emerging risk from autonomous AI agents, then presents Cisco's agentic security reference architecture. It recounts the ILOVEYOU worm (2000), a social-engineering email worm, and WannaCry (2017), a ransomware worm using EternalBlue against unpatched Windows systems…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
