EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR flags multiple Cisco vulnerabilities enabling remote code execution, privilege escalation and DoS across IOS XE, IOS XR, FTD and more

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 21:00 · coletado há 6 dias

CERT-FR published advisory CERTFR-2026-AVI-1360 on 22 October 2026 covering multiple vulnerabilities in Cisco products, based on Cisco security advisories released on 21 and 22 October 2026. Some of the flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service, as well as breach data integrity and confidentiality and bypass the security policy. The advisory references about 30 CVEs and does not report active exploitation. Affected products include IOS XE, IOS XR, Secure FTD, Expressway Series, Secure Client, Snort 3, Cyber Vision and the Unified Communications portfolio.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1360 groups about 30 CVEs in Cisco products, based on Cisco advisories of 21 and 22 October 2026. Some of them allow remote arbitrary code execution, privilege escalation and remote denial of service, plus integrity and confidentiality breaches and security policy bypass. The advisory does not map CVEs to impacts and gives no CVSS scores, so the most severe flaw cannot be named. Affected: IOS XE 17.12.x before 17.12.8, 17.15.x before 17.15.6, 17.18.x before 17.18.5, 26.1.x before 26.1.2 and 26.2.x before 26.2.1; IOS XR 7.9 to 24.4.x (fixed releases and SMUs tied to CSCwn39554 for ASR 9000); Secure FTD 7.0 to 10.1 (fixed from 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0); Expressway before X15.5.20; Cyber Vision before 5.6.0; Unified CM family before 15SU5; Snort 3 before 3.12.4.0; Secure Client up to 5.1.20.333.

Como funciona

The sources do not describe how any of these flaws work. The CERT-FR advisory only lists impact categories and affected versions, and the underlying Cisco advisories are referenced but their content is not reproduced. No input path, vulnerable component or failing step can be stated for individual CVEs without guessing. Defenders need to read each Cisco advisory to see which CVE applies to their product and what conditions are required.

Por que é vulnerável

The articles do not state root causes. The only hints are the names of the Cisco advisories, which refer to hardening, static credentials (Expressway/VCS), privilege escalation in Secure Client, open-source components in Snort 3 and PHP, but they are not tied to specific CVEs here. The fix is to move to the fixed versions or apply the SMUs listed by Cisco.

Como foi descoberta

CERT-FR published the advisory on 22 October 2026, drawing on Cisco security advisories released on 21 October (asr9k, Expressway hardening, Snort 3, Secure Client, VCS static credentials, voice hardening) and 22 October (PHP). The sources do not say who found the flaws or how, and the advisory does not report active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:19.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • Affected: Cyber Vision before 5.6.0; Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection after 14 and before 15SU5; Expressway Series after X14 and before X15.5.20; Secure Client up to 5.1.20.333; Snort 3 before 3.12.4.0.
  • IOS XE: 17.12.x before 17.12.8, 17.15.x before 17.15.6, 17.18.x before 17.18.5, 26.1.x before 26.1.2, 26.2.x before 26.2.1.
  • IOS XR: 7.9, 7.10, 7.11, 24.1, 24.2, 24.3 and 24.4.x, each with fixed releases and SMUs tied to CSCwn39554 for ASR 9000 (asr9k-x64).
  • Secure FTD: 7.0.x before 7.0.10, 7.2.x before 7.2.12, 7.4.x before 7.4.8, 7.6.x before 7.6.6, 7.7.x before 7.7.13, 10.0.x before 10.0.2, 10.1.x before 10.1.0.
  • Source Cisco advisories: cisco-sa-asr9k-tUyxcyXN, cisco-sa-exwy-hardening-FhcqBVcs, cisco-sa-hardening-snort3-ybgmhTQe, cisco-sa-opensrc-snort3-2fXGJPfe, cisco-sa-sec-client-priv-esc-muF8eZdm, cisco-sa-vcs-static-cred-hr7EWZ8t, cisco-sa-voice-hardening-twgbH9e3 and cisco-sa-php-october26-Jj384Daq.
  • The advisory does not map individual CVEs to specific impacts and gives no CVSS scores or exploitation details.

Remediação

  • Apply the fixed versions and SMUs described in the Cisco security advisories, as CERT-FR directs.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 21/10/2026 21:00 · coletado 26/10 14:01 primeiro registro

    CERT-FR flags multiple Cisco vulnerabilities enabling remote code execution, privilege escalation and DoS across IOS XE, IOS XR, FTD and more

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1360 on 22 October 2026 covering multiple vulnerabilities in Cisco products, based on Cisco security advisories released on 21 and 22 October 2026. Some of the flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service, as well as breach data integrity and confidentiality and bypass the security policy. The advisory references about 30 CVEs and does not report active exploitation. Affected products include IOS XE, IOS XR, Secure FTD, Expressway Series, Secure Client, Snort 3, Cyber Vision and the Unified Communications portfolio.

    Technical Details

    • Affected: Cyber Vision before 5.6.0; Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection after 14 and before 15SU5; Expressway Series after X14 and before X15.5.20; Secure Client up to 5.1.20.333; Snort 3 before 3.12.4.0.
    • IOS XE: 17.12.x before 17.12.8, 17.15.x before 17.15.6, 17.18.x before 17.18.5, 26.1.x before 26.1.2, 26.2.x before 26.2.1.
    • IOS XR: 7.9, 7.10, 7.11, 24.1, 24.2, 24.3 and 24.4.x, each with fixed releases and SMUs tied to CSCwn39554 for ASR 9000 (asr9k-x64).
    • Secure FTD: 7.0.x before 7.0.10, 7.2.x before 7.2.12, 7.4.x before 7.4.8, 7.6.x before 7.6.6, 7.7.x before 7.7.13, 10.0.x before 10.0.2, 10.1.x before 10.1.0.
    • Source Cisco advisories: cisco-sa-asr9k-tUyxcyXN, cisco-sa-exwy-hardening-FhcqBVcs, cisco-sa-hardening-snort3-ybgmhTQe, cisco-sa-opensrc-snort3-2fXGJPfe, cisco-sa-sec-client-priv-esc-muF8eZdm, cisco-sa-vcs-static-cred-hr7EWZ8t, cisco-sa-voice-hardening-twgbH9e3 and cisco-sa-php-october26-Jj384Daq.
    • The advisory does not map individual CVEs to specific impacts and gives no CVSS scores or exploitation details.

    Remediation

    • Apply the fixed versions and SMUs described in the Cisco security advisories, as CERT-FR directs.