CERT-FR: Multiple vulnerabilities in Cisco products, including remote code execution (Cisco advisories of 27 Oct and 4 Nov 2026)
The CERT-FR advisory CERTFR-2026-AVI-1467 (5 November 2026) relays two Cisco security advisories: cisco-sa-oct2026-node-js-Jj3SQ19u (27 October 2026) and cisco-sa-cucs-rce-LzHSFRDQ (4 November 2026). It covers five CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 and CVE-2026-76506. CERT-FR says they allow remote arbitrary code execution, a security policy bypass and an unspecified security issue. The page gives no CVSS scores, prerequisites or exploitation in the wild. It also does not say which CVE affects which product. Several fixes are not yet available.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1467 relays two Cisco bulletins (cisco-sa-oct2026-node-js-Jj3SQ19u and cisco-sa-cucs-rce-LzHSFRDQ) covering CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 and CVE-2026-76506. It says they allow remote arbitrary code execution, a security policy bypass and an unspecified security issue. The page does not map CVEs to products, give CVSS scores, or state prerequisites such as authentication or user interaction. Affected products include BPA (before 4.1.2, 5.0 and 5.1), Catalyst Center before 3.4.1, Duo Authentication Proxy Local Manager for Windows before 6.8.1, Duo Network Gateway before 3.4.2, Packet Tracer before 9.2.0, Private 5G before 22.23.4, Spaces before 24.22.1, UCS Central before 2.1(2c), Webex Connect before 6.22.2, Intersight, Secure Endpoint Private Cloud Appliance, Smart PHY, Virtualized Infrastructure Manager and Nexus 9000 in standalone NX-OS (Guest Shell). Fixes are scheduled between November 2026 and July 2027, and some have no date yet.
Como funciona
The articles do not describe how the vulnerable code works, which component receives the malicious input or at which step it fails. Only the bulletin names hint at the area: one refers to Node.js, the other to remote code execution in a bulletin whose identifier contains cucs-rce. The mechanism cannot be explained without guessing, so consult the Cisco bulletins for details.
Por que é vulnerável
The articles do not state the root cause or the bug class of any of the five CVEs, nor what the fixes change. CERT-FR only lists the impact categories: remote code execution, security policy bypass and an unspecified issue.
Como foi descoberta
The articles do not say who found the flaws or how. Cisco published the advisories on 27 October 2026 (cisco-sa-oct2026-node-js-Jj3SQ19u) and 4 November 2026 (cisco-sa-cucs-rce-LzHSFRDQ), and CERT-FR relayed them on 5 November 2026. The CERT-FR page reports no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:28.
Detalhes técnicos
The advisory names the Node.js-related bulletin and a bulletin with RCE in its identifier (cucs-rce). It does not describe the bug classes, state the product of that bulletin or map CVEs to products. The affected products listed are:
- Business Process Automation (BPA), versions before 4.1.2, before 5.0 and before 5.1
- Catalyst Center, versions before 3.4.1
- Duo Authentication Proxy Local Manager for Windows, versions before 6.8.1
- Duo Network Gateway, versions before 3.4.2
- Intersight and Intersight Virtual Appliance
- Nexus 9000 Series Switches in standalone NX-OS mode (Guest Shell)
- Packet Tracer, versions before 9.2.0
- Private 5G, versions before 22.23.4
- Secure Endpoint Private Cloud Appliance
- Smart PHY
- Spaces, versions before 24.22.1
- UCS Central Software, versions before 2.1(2c)
- Virtualized Infrastructure Manager
- Webex Connect, versions before 6.22.2
Remediação
Fixes are planned for these products, according to CERT-FR:
- BPA before 5.0: November 2026
- Duo Authentication Proxy Local Manager for Windows before 6.8.1: November 2026
- Intersight, Intersight Virtual Appliance, Secure Endpoint Private Cloud Appliance and Webex Connect: November 2026
- Packet Tracer: December 2026
- Smart PHY: March 2027
- Catalyst Center: July 2027
- BPA before 4.1.2 and before 5.1, and Private 5G: date to be determined
- Duo Network Gateway, Spaces, UCS Central Software, Nexus 9000 (Guest Shell) and Virtualized Infrastructure Manager: no fix date given on the CERT-FR page
CERT-FR refers readers to the Cisco bulletins for the fixes.
Linha do tempo
-
CERT-FR: Multiple vulnerabilities in Cisco products, including remote code execution (Cisco advisories of 27 Oct and 4 Nov 2026)
ler a análise desta fonte ocultar
The CERT-FR advisory CERTFR-2026-AVI-1467 (5 November 2026) relays two Cisco security advisories: cisco-sa-oct2026-node-js-Jj3SQ19u (27 October 2026) and cisco-sa-cucs-rce-LzHSFRDQ (4 November 2026). It covers five CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 and CVE-2026-76506. CERT-FR says they allow remote arbitrary code execution, a security policy bypass and an unspecified security issue. The page gives no CVSS scores, prerequisites or exploitation in the wild. It also does not say which CVE affects which product. Several fixes are not yet available.
Technical Details
The advisory names the Node.js-related bulletin and a bulletin with RCE in its identifier (cucs-rce). It does not describe the bug classes, state the product of that bulletin or map CVEs to products. The affected products listed are:
- Business Process Automation (BPA), versions before 4.1.2, before 5.0 and before 5.1
- Catalyst Center, versions before 3.4.1
- Duo Authentication Proxy Local Manager for Windows, versions before 6.8.1
- Duo Network Gateway, versions before 3.4.2
- Intersight and Intersight Virtual Appliance
- Nexus 9000 Series Switches in standalone NX-OS mode (Guest Shell)
- Packet Tracer, versions before 9.2.0
- Private 5G, versions before 22.23.4
- Secure Endpoint Private Cloud Appliance
- Smart PHY
- Spaces, versions before 24.22.1
- UCS Central Software, versions before 2.1(2c)
- Virtualized Infrastructure Manager
- Webex Connect, versions before 6.22.2
Remediation
Fixes are planned for these products, according to CERT-FR:
- BPA before 5.0: November 2026
- Duo Authentication Proxy Local Manager for Windows before 6.8.1: November 2026
- Intersight, Intersight Virtual Appliance, Secure Endpoint Private Cloud Appliance and Webex Connect: November 2026
- Packet Tracer: December 2026
- Smart PHY: March 2027
- Catalyst Center: July 2027
- BPA before 4.1.2 and before 5.1, and Private 5G: date to be determined
- Duo Network Gateway, Spaces, UCS Central Software, Nexus 9000 (Guest Shell) and Virtualized Infrastructure Manager: no fix date given on the CERT-FR page
CERT-FR refers readers to the Cisco bulletins for the fixes.