17 casos · pág. 1/1
Cisco disclosed a critical vulnerability, CVE-2026-76466, in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access could execute arbitrary operating system commands as root. The flaw stems from the use of persistent cookies and insufficient client certificat…
Cisco published a September 2026 hardening release for Cisco Secure Firewall ASA, Secure Firewall Threat Defense (FTD) and Secure Firewall Management Center (FMC) software. It addresses multiple vulnerabilities found during an internal security review. Cisco rates the advisory Critical and states that two of the issues are known to be act…
Cisco disclosed a critical authentication bypass, CVE-2026-76504, in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. An unauthenticated, remote attacker can send a crafted HTTP request and gain access to the API with the privileges of the admin user. Cisco has released software updates and states that no …
Cisco published a security advisory covering multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem). A remote attacker could exploit them to gain unauthorized access, access sensitive information, cause a denial of service (DoS)…
Cisco disclosed multiple critical vulnerabilities in the Next Generation OAM (NGOAM) feature of Cisco NX-OS Software, affecting Cisco Nexus 3000 Series and Nexus 9000 Series switches. An unauthenticated, remote attacker could execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. The flaws ar…
Cisco disclosed a critical vulnerability, CVE-2026-76465, in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series and Nexus 9000 Series switches. An unauthenticated, remote attacker could execute arbitrary code with root privileges or cause a denial of service (DoS) on an af…
Cisco disclosed a critical vulnerability, CVE-2026-76471, in the NX-API feature of Cisco NX-OS Software. An unauthenticated, remote attacker could use it to execute arbitrary code with root privileges or to cause a denial of service on an affected device. Cisco rates the Security Impact as Critical. Software updates are available and no w…
Cisco published a security hardening release for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (September 2026), fixing multiple vulnerabilities found during an internal security review. Cisco states that two of them are known to be actively exploited. They are described in separate advisories as a SQL injection and an…
On October 21, the PHP Foundation released a Critical PHP Security release fixing two critical remote code execution vulnerabilities, collectively referred to as PHP2shell. Cisco published an advisory on how these flaws affect its products and rated the security impact Critical. The excerpt does not list which Cisco products are affected,…
CERT-FR advisory CERTFR-2026-AVI-1325, published 15 October 2026, reports a vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows a remote attacker to execute arbitrary code and compromise data integrity. Cisco states that CVE-2026-76519 is actively exploited. The advisory is based on Cisco security advisory c…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-14 based on evidence of active exploitation: CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the f…
Cisco disclosed that CVE-2026-76519, a critical (CVSS 9.8) flaw in Secure Email Gateway (SEG), has been exploited as a zero-day before a fix was available. A remote, unauthenticated attacker can write files and execute commands as root on the appliance simply by sending a malicious email. CISA added the flaw to its Known Exploited Vulnera…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. CISA describes these vulnerability types as a…
A zero-day vulnerability in BeyondTrust Remote Support is being reported as the latest in a run of edge-device bugs under attack. In the same week, vulnerabilities in edge products from Ivanti, Cisco and Palo Alto Networks also came under fire. The article, which is very brief, frames BeyondTrust as joining this group and as continuing th…
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
Microsoft released updates for at least 974 vulnerabilities in Windows and other software, its largest Patch Tuesday ever. The previous record was 570 fixes in July. The 2026 total now exceeds 2,600, more than double the 2020 record year (1,245), with three months still to go. Microsoft and other large vendors, including Adobe, Cisco, Goo…
A joint StopRansomware advisory (AA26-293A) from CISA, the FBI, the USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026 (cisa.gov). The group has been active since August 2024 and has compromised …
