Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Cisco will publish October 21, 2026 advisories and fixes for Expressway, IOS XR, Secure Client, Snort, and UC products.
24
Product
Cisco IOS XR
- Mentions · 7d0
- Mentions · 30d1
- All mentions7
- First seenAug 31, 2026
- Last mentioned18d ago
Timeline
7 articles · newest firstCisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.
68
Cisco security advisory (AV26-876)
Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.
26
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
70
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
35
China-linked Fire Ant Hides Inside Trusted Infrastructure
China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.
74
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
78
Related CVEs
by mentions- CVE-2026-8207863%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157885%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-20279<1%9.8Critical Improper Access Control in Cisco IOS XR Software
- CVE-2026-20274<1%9.8Critical Improper Resource Control Flaws in Cisco IOS XR Software
- CVE-2026-74232<1%9.3Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
- CVE-2026-66747<1%9.3Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
- CVE-2026-742333%9.3Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
Appears with
- Ciscovendor · 6
- Fire Antthreat actor · 4
- UNC3886threat actor · 4
- Sygniavendor · 3
- Salt Typhoonthreat actor · 3
- Volt Typhoonthreat actor · 2
- SentinelOnevendor · 2
- Sygniaorganization · 2
- QScanproduct · 1
- FBIorganization · 1
- Beauceron Securityorganization · 1
- QTFYthreat actor · 1
- Hugging Facevictim · 1
- Info-Tech Research Grouporganization · 1
- Cisco Expresswayproduct · 1
- VMware ESXiproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.