CISA adds exploited GitLab and Cisco firewall flaws to KEV
Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.
84
- Mentions · 7d46
- Mentions · 30d133
- All mentions302
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
302 articles · newest firstBuyer’s guide compares 12 incident response retainer services
The review weighs SLAs, unused-hour conversion, onboarding and post-acquisition ownership rather than responder reputation alone.
24
Buyer's guide ranks 12 DFIR firms; Coveware now under Veeam
The guide matches firms to breach lanes and flags Coveware's acquisition by Veeam as a procurement issue.
22
Buyer's guide compares 12 managed SIEM services for 2026
The review weighs content ownership, offboarding, tuning evidence and whether the SIEM stays in the customer's tenant.
18
2026 ranking puts Recorded Future first among CTI providers
Mandiant and CrowdStrike place second and third; Kaspersky is flagged as jurisdiction-gated for Western buyers.
17
CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV
Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.
82
Fake IT help desk calls led to remote access and VYPR ransomware
Cisco Talos says callers often knew only names and emails, and one Quick Assist session ended in ransomware.
68
Cisco ASA and FTD SSL VPN flaw exploited to crash devices
CVE-2026-76418, scored 8.6, lets an unauthenticated attacker reload ASA or FTD when secondary authentication is configured; Cisco has fixes but no workaround.
78
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
62
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
Cisco open-sources Quarry to detect multi-step AI agent attacks
The neurosymbolic rule language is meant to flag intent that appears only across benign agent steps.
48
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
88
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
84
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Cisco says CVE-2026-76418 in Secure Firewall is exploited in the wild
ASA and FTD releases before the listed builds are affected by a remote SSL VPN tunnel denial of service.
76
Cisco ASA and FTD SSL VPN zero-day crashed firewalls in attacks
Unauthenticated attackers can reload devices that have webvpn and SSL VPN enabled; Cisco found exploitation in October 2026.
78
Cisco patches actively exploited ASA and FTD VPN crash flaw
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
82
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
92
Cisco patches exploited ASA and FTD SSL VPN zero-day
CVE-2026-76418, CVSS 8.6, lets unauthenticated attackers restart firewalls when secondary authentication is configured.
76
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
Cisco patches exploited ASA and FTD SSL VPN flaw CVE-2026-76418
Unauthenticated crafted VPN requests can reload firewalls; CVSS is 8.6 and there is no workaround.
78
2026 buyer’s guide compares 12 SIEM platforms
The guide stresses pricing fit and ownership changes, including QRadar’s split lanes and Splunk under Cisco.
17
2026 SIEM rankings put Microsoft Sentinel first, then Splunk and Google
An editorial scorecard, not a lab test, ranks nine platforms after the Exabeam–LogRhythm merger removed one slot.
22
Cisco Secure Firewall VPN flaw CVE-2026-76418 exploited to crash devices
Unauthenticated crafted requests reload ASA and FTD devices when SSL VPN secondary authentication is configured; CVSS is 8.6.
78
CISA KEV lists Cisco firewall DoS flaw CVE-2026-76418
Unauthenticated remote attackers can reload ASA and Secure FTD devices; the federal due date is November 1, 2026.
74
Cisco Catalyst SD-WAN peering flaw bypasses authentication for admin access
An unauthenticated remote attacker can send crafted requests and log in with administrative privileges.
64
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
86
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
66
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Cisco ASA and FTD SSL VPN flaw can remotely reload devices
Unauthenticated attackers can crash devices when secondary authentication is set on a tunnel group; Cisco has shipped updates.
54
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Cisco to publish November 4 advisories for ISE, UCS, and UCM
Fixed releases will be named then, and PSIRT plans no further hardening advisories in 2026.
32
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
Unauthenticated SSRF in Cisco Finesse exposes limited internal data
Cisco rates CVE-2026-20362 at 7.2 and says no fixes exist yet, with first patches planned for 2027.
64
Cisco open-sources Project Quarry to flag rogue AI agents
Quarry scores full agent sessions, including tool use and MCP calls, and ships a YARA-like rule starter pack.
48
Related CVEs
by mentions- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-2007989%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-7650439%9.8Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager
- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-765192%9.8Relative Path Traversal to Root RCE in Cisco Secure Email Gateway
- CVE-2026-7646130%9.8Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway
- CVE-2026-76418<1%8.6Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2026-203491%8.6Unauthenticated Remote DoS in Cisco ASA/FTD SSL VPN Service
Appears with
- Ciscoorganization · 70
- CISAorganization · 55
- Cisco Talosorganization · 37
- Cisco Identity Services Engineproduct · 35
- Microsoftvendor · 28
- Palo Alto Networksvendor · 23
- Cisco Secure Email Gatewayproduct · 22
- Cisco Secure Firewall Management Centerproduct · 22
- Googlevendor · 20
- Cisco Catalyst SD-WAN Managerproduct · 17
- Volt Typhoonthreat actor · 16
- Cisco PSIRTorganization · 14
- Fortinetvendor · 14
- Citrixvendor · 14
- CISAvendor · 13
- Cisco ISE Passive Identity Connectorproduct · 13
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.