ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “cisco”

203 items in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 57Exploit / PoC 55Industry 23Vulnerability 18Threat actor 15Malware 8Phishing & fraud 6Tools 5Research 4AI industry 3AI safety & security 3Policy & legal 3Ransomware 1Model release 1
SeverityAllcritical 49high 49medium 49low 15info 41

Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks

Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.

Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.

BleepingComputer · 8d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316

Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks

Cisco confirms zero-day CVE-2026-76460 (CVSS 10.0) in ISE is under active exploitation, granting unauthenticated root command execution; patches released.

Cisco's PSIRT issued an urgent advisory for CVE-2026-76460, an authentication bypass via insufficient controls on an API endpoint in Cisco ISE and ISE-PIC, confirmed to be actively exploited with a CVSS score of 10.0. Exploitation can yield root-level command execution, enabling persistence, credential theft, and lateral movement from the network policy platform. Fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4; EOL version 3.0 requires migration, and iACLs offer only temporary mitigation. The flaw was discovered while resolving a TAC support case, and Cisco provides hunting guidance including access.log review and firewall log analysis.

Cyber Security Newsupdated · 17h agofirst · 1d agoExploit / PoC in the wild 26 sourcesCVE-2026-76460

Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.

Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.

GBHackersupdated · 17h agofirst · 1d agoVulnerability in the wild 26 sourcesCVE-2026-76460

Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root

Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.

Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.

GBHackersupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-764613

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco warns CVE-2026-76460 (CVSS 10.0), an unauthenticated ISE auth bypass leading to root command execution, is under active exploitation and was added to CISA's KEV.

Cisco warned that CVE-2026-76460 (CVSS 10.0), an insufficient-authentication flaw in an Identity Services Engine (ISE) API endpoint, is being actively exploited by unauthenticated remote attackers and can yield root-privilege command execution on ISE and ISE-PIC regardless of configuration. Fixes shipped across ISE 3.1 through 3.5 patch branches; Cisco advised reviewing access.log for unexpected usernames (e.g., "dummyuser"), re-imaging affected nodes, and using iACLs, since no workarounds exist. CISA added the flaw to its KEV catalog on September 16, 2026, requiring FCEB agencies to patch by September 19. Cisco simultaneously issued 77 new CVEs, 41 affecting ISE and 28 affecting Secure Firewall products, days after confirming active exploitation of CVE-2026-76461 in Secure Email Gateway.

The Hacker News · 1d agoExploit / PoC in the wildCVE-2026-76460CVE-2026-76461CVE-2026-20176+27 CVEs2

Cisco warns customers of actively exploited zero-day in email gateways

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.

Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.

CyberScoopupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker News · 14d agoVulnerabilityCVE-2026-20212CVE-2026-20274CVE-2026-20279+5 CVEs

AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460

Canada's Cyber Centre alerts on three actively exploited Cisco ISE/ISE-PIC vulnerabilities enabling unauthenticated administrative access and data tampering.

Canada's Cyber Centre issued alert AL26-021 for three flaws in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): CVE-2026-20192 (improper access control, CWE-284), CVE-2026-76423 (authentication bypass by spoofing, CWE-290), and CVE-2026-76460 (incorrect use of privileged APIs, CWE-648). Successful exploitation could let unauthenticated attackers bypass authentication, gain administrative access, and read or modify ISE configuration and identity data. Cisco confirmed active exploitation of CVE-2026-76460, which CISA added to its KEV catalog on September 16, 2026. Fixes ship in ISE 3.1–3.5 patches, and defenders are urged to prioritize that CVE, restrict management interfaces, and hunt for IoCs.

Canadian Centre for Cyber Securityupdated · 17h agofirst · 20h agoAdvisory in the wild 26 sourcesCVE-2026-20192CVE-2026-76423CVE-2026-76460

Cisco alerts customers to second actively exploited zero-day in as many days

Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.

Cisco disclosed CVE-2026-76460, exploited before patching and discovered during a technical support case, in an ISE API allowing remote unauthenticated root access; CISA quickly added it to KEV. It is the third actively exploited ISE flaw since June 2025, after CVE-2025-20337 and CVE-2025-20281. It is unrelated to CVE-2026-76461, the Secure Email Gateway zero-day disclosed days earlier. Cisco published IOCs, said no workarounds exist, and no threat actor has been attributed.

CyberScoop · 17h agoExploit / PoC in the wild 26 sourcesCVE-2026-76460CVE-2026-76461CVE-2025-20337+1 CVEs

Cisco Secure Email Gateway Vulnerability Exploited in Attacks (CVE-2026-76461)

Cisco Secure Email Gateway flaw CVE-2026-76461 enables root command execution via crafted email SQL injection and is actively exploited, added to CISA KEV.

Cisco disclosed critical vulnerability CVE-2026-76461 in Secure Email Gateway, caused by insufficient validation in email parsing logic, allowing arbitrary SQL statements that lead to root-level command execution. CISA added the flaw to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 17, 2026. The bug affects all SEG deployments regardless of configuration, with fixed releases including 15.5.5-014, 16.0.4-302, and 16.5.0-780. Defenders can check mail_logs for anomalous 'COPY ... TO PROGRAM' SQL statements to detect compromise.

Qualys ThreatPROTECTupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)

Actively exploited zero-day SQL injection (CVE-2026-76461) in Cisco Secure Email Gateway allows unauthenticated root command execution; CISA ordered federal remediation by September 17.

Cisco confirmed attackers are exploiting zero-day CVE-2026-76461, an unauthenticated SQL injection in the email parsing logic of AsyncOS on Secure Email Gateway appliances (versions 16.5, 16.0, 15.5 and earlier) and Secure Email Cloud. Successful exploitation yields arbitrary SQL execution and root-level command execution on the underlying OS without user interaction. Cisco became aware of active exploitation in September 2025, has directly contacted affected cloud customers, and released fixed releases 15.5.5-014, 16.0.4-302, and 16.5.0-780. CISA added the flaw to its Known Exploited Vulnerabilities catalog and required federal civilian agencies to patch by September 17 and hunt for compromise.

Help Net Securityupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461CVE-2025-20393

Cisco drops another exploited zero-day, this time a perfect 10

Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.

Cisco disclosed CVE-2026-76460 (CVSS 10.0), an authentication bypass in Identity Services Engine (ISE) and ISE-PIC APIs that gives unauthenticated remote attackers command execution with root privileges; CISA added it to the KEV catalog. It follows CVE-2026-76461 (CVSS 9.8), an actively exploited flaw in Cisco Secure Email Gateway and Secure Email and Web Manager disclosed days earlier. Permanent fixes ship in ISE 3.1 Patch 12 through 3.5 Patch 4; ISE 3.0 is end-of-maintenance and ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4 are available. No workaround exists, though ACLs restricting management traffic can serve as temporary mitigation.

The Register · Securityupdated · 17h agofirst · 1d agoExploit / PoC in the wild 26 sourcesCVE-2026-76460CVE-2026-764615· 1 read

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.

CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.

BleepingComputer · 1d agoExploit / PoC in the wildCVE-2026-76460CVE-2026-76423CVE-2026-20176+4 CVEs1· 1 read

Cisco email security boxes can be rooted by... an email

Attackers actively exploit critical Cisco Secure Email Gateway flaw CVE-2026-76461, turning a malicious email into unauthenticated root access.

Cisco Secure Email Gateway appliances are being actively exploited via CVE-2026-76461, a CVSS 9.8 AsyncOS flaw requiring no authentication—a crafted email can yield root command execution with no workarounds. Cisco's PSIRT became aware of active exploitation in September; some Secure Email Cloud customers showed indicators of compromise and all cloud devices were upgraded to AsyncOS 16.5.0-780. The bug is in CISA's KEV catalog with federal agencies ordered to remediate by September 17; Shadowserver counted 400+ exposed appliances. Fixes are available in AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780, and attackers with root may tamper with logs to hide activity.

The Register · Securityupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461CVE-2025-20393

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.

Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.

CSO Online · 9d agoVulnerabilityCVE-2026-20274CVE-2026-20279

Cisco Warns of Active Exploitation of Critical ISE Flaw

Cisco warns that CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is actively exploited, enabling unauthenticated root access; CISA added it to KEV.

Cisco disclosed CVE-2026-76460, a CVSS 10.0 flaw caused by insufficient control of an API endpoint in Cisco ISE and ISE-PIC, allowing crafted requests to bypass the web-based management interface and potentially obtain root command execution. Active exploitation is confirmed; patches are available and no workarounds exist, though infrastructure access control lists can restrict management traffic as an interim measure. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring FCEB agencies to prioritize patching. Cisco urges checking access.log on every node, reimaging suspected compromised nodes, and reviewing external firewall logs for unexpected uploads.

Infosecurity Magazineupdated · 17h agofirst · 1d agoExploit / PoC in the wild 26 sourcesCVE-2026-76460

Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.

Cisco confirmed active exploitation of CVE-2026-76460, caused by insufficient authentication control on an ISE API endpoint. A remote, unauthenticated attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access to affected devices. The flaw affects Cisco ISE and ISE-PIC releases 3.0 through 3.5; fixes are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, with no workarounds. Cisco provided IoCs, advises checking access.log for suspicious usernames, cross-checking firewall and network logs, and re-imaging suspect nodes since attackers may delete ISE logs.

Help Net Securityupdated · 17h agofirst · 1d agoExploit / PoC in the wild 26 sourcesCVE-2026-76460

12 Best Kubernetes Security Tools Compared (2026): Features & Pricing

GBHackers compares 12 Kubernetes security vendors including Sysdig, Wiz, Aqua, and Cisco Isovalent on features, pricing units, and procurement strategy.

GBHackers publishes a 2026 buying guide comparing 12 Kubernetes security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, Snyk, Cisco Isovalent, Palo Alto Networks, Fairwinds, Red Hat ACS, and Tigera. It argues CNCF-grade open source (Kubescape, Falco, Trivy, Calico, Cilium/Tetragon) provides free posture, runtime, and network policy coverage that resets price negotiations. Cisco's acquisition of Isovalent places the eBPF data plane under a networking giant, while the paid market focuses on multi-cluster policy, enforcement, and support. The piece emphasizes that pricing units (workload, node, cluster, developer, credits) heavily influence contract costs.

GBHackersupdated · 5h agofirst · 2d agoTools 10 sources3

Cisco patches max-severity ISE flaw, the second critical zero-day this week

Cisco emergency-patched actively exploited CVE-2026-76460 (CVSS 10.0), an unauthenticated API flaw granting root on ISE appliances; CISA added it to KEV.

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in a Cisco Identity Services Engine management API that lets unauthenticated attackers gain root privileges. It affects ISE and ISE-PIC in all configurations and is fixed in 3.1 Patch 12 through 3.5 Patch 4. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirmed in-the-wild exploitation. A broader review fixed 21 critical ISE flaws plus high- and medium-severity issues, following earlier exploited firewall flaws CVE-2026-20079 and CVE-2026-20131.

CSO Online · 17h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-20079CVE-2026-201312· 2 reads

Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard

Cisco patches dozens of critical flaws in FMC, ISE and Nexus Dashboard, including ISE bugs and an authentication bypass already exploited in the wild.

Cisco released patches for dozens of critical-severity CVEs in Secure Firewall Management Center, Identity Services Engine and Nexus Dashboard. ISE updates cover 20 CVEs including 12 critical ones; three publicly disclosed flaws (CVE-2026-20282, CVE-2026-20283, CVE-2026-20284) enable SQL injection, data tampering and command execution but require administrative access. FMC patches fix 18 CVEs, eight critical, several shared with ASA and FTD, where CVE-2026-20079 and CVE-2026-20316 have been exploited since August. Cisco also warned of a critical-severity ISE authentication bypass exploited in the wild as a zero-day.

SecurityWeek · 1d agoVulnerability in the wild 2 sourcesCVE-2026-20282CVE-2026-20283CVE-2026-20284+3 CVEs1

Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.

Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.

BleepingComputer · 3d agoExploit / PoC in the wildCVE-2026-76461CVE-2026-76440CVE-2026-76441+3 CVEs

Cisco security advisory (AV26-932)

Cisco September 2026 updates fix flaws in ASA, FTD, FMC, ISE, and Nexus Dashboard; CISA added actively exploited CVE-2026-76460 to KEV.

Cisco's September 2026 hardening releases address vulnerabilities across Secure Firewall Threat Defense and Management Center, ASA, Identity Services Engine, ISE-PIC, and Nexus Dashboard, with fixes in branches such as FTD/FMC 7.0.10-10.1.0, ASA 9.16.4.103-9.24.1.26, and ISE 3.1 Patch 12-3.5 Patch 4. CISA added CVE-2026-76460, a Cisco Identity Services Engine authentication bypass, to its Known Exploited Vulnerabilities catalog on September 16, 2026. The Canadian Centre for Cyber Security urges users and administrators to review the advisories and apply the updates.

Canadian Centre for Cyber Securityupdated · 17h agofirst · 22h agoAdvisory in the wild 26 sourcesCVE-2026-76460

Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.

Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.

BleepingComputer · 7d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-203161

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber Security · 8d agoExploit / PoC in the wildCVE-2026-20131CVE-2026-20079

Cisco searched for IOS XR bugs and found so many it rolled them into an update release

Cisco patched three critical flaws, including CVE-2026-20212 unauthenticated remote root code execution in Nexus 9000 switches; no exploitation observed yet.

Cisco disclosed three critical-rated flaws found during a comprehensive internal security review. CVE-2026-20274 and CVE-2026-20279, both CVSS 9.8, affect the IOS XR carrier-grade operating system and are fixed in newly released versions. CVE-2026-20212 lets unauthenticated remote attackers execute code with root privileges on some Nexus 9000 Series Switches by reaching TCP ports 43210 and 43211 in the default Layer 3 VRF; no software fix exists yet, only infrastructure ACL mitigations. Cisco says it has not observed attacks against these flaws.

The Register · Security · 14d agoVulnerabilityCVE-2026-20274CVE-2026-20279CVE-2026-20212

Cisco Fixed Critical RCE in Nexus 9000 Series Switches

Cisco patched CVE-2026-20212 (CVSS 9.8) in Silicon One-based Nexus 9000 switches, allowing unauthenticated remote root code execution via TCP ports 43210/43211.

Cisco patched CVE-2026-20212 (CVSS 9.8), a flaw in the Silicon One integration for Nexus 9000 Series switches that lets unauthenticated remote attackers execute code with root privileges. TCP ports 43210 and 43211 are exposed through the default Layer 3 VRF, and exploitation can also crash the S1HAL process, forcing device reloads. Cisco TAC discovered the flaw during a support case; PSIRT is not aware of public disclosure or malicious exploitation. Workarounds include infrastructure ACLs or blocking the exposed ports, alongside a Live Protect shield pending fixed NX-OS upgrades.

Security Affairs · 14d agoVulnerabilityCVE-2026-20212

CISA Warns of Cisco Identity Services Engine Authentication Bypass Vulnerability (CVE-2026-76460)

CISA added actively exploited Cisco ISE authentication bypass CVE-2026-76460 to its KEV catalog, urging patches by September 19, 2026.

Cisco patched CVE-2026-76460, a critical authentication bypass in Cisco Identity Services Engine and ISE Passive Identity Connector caused by insufficient authentication controls on an API endpoint. An unauthenticated remote attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and set a September 19, 2026 remediation deadline. Fixed releases span ISE 3.1 Patch 12 through 3.5 Patch 4; release 3.0 is end-of-maintenance and requires an upgrade.

Qualys ThreatPROTECTupdated · 17h agofirst · 1d agoExploit / PoC in the wild 26 sourcesCVE-2026-76460

12 Best Kubernetes Security Tools Compared (2026): Features & Pricing

A buying-guide comparison of twelve Kubernetes security vendors, from free OSS tools like Falco and Kubescape to paid platforms led by Sysdig and Aqua.

The article compares features and pricing mechanics for twelve Kubernetes security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, Snyk, Isovalent (Cisco), Palo Alto Prisma Cloud, Fairwinds, Red Hat ACS (StackRox), and Tigera. It argues CNCF-grade open source (Kubescape, Falco, Calico, NeuVector, Cilium/Tetragon) provides a free floor for posture, runtime, and network policy. Pricing hinges on node-versus-cluster-versus-developer billing units, and Cisco's Isovalent acquisition consolidates the eBPF layer inside a networking giant.

GBHackersupdated · 5h agofirst · 2d agoTools 10 sources1

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Cisco warns CVE-2026-76461 in Secure Email Gateway AsyncOS is actively exploited, letting unauthenticated attackers run root commands via crafted emails.

Cisco disclosed CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS for Cisco Secure Email Gateway caused by insufficient validation in email parsing, allowing unauthenticated remote attackers to execute arbitrary SQL statements leading to root command execution. Active exploitation began in September 2026, and CISA added the flaw to its KEV catalog, requiring FCEB agencies to patch by September 17, 2026. Fixes are available in AsyncOS 15.5.5-0141, 16.0.4-302, and 16.5.0-780, with no workarounds. Cisco also contacted Secure Email Cloud customers where malicious activity was detected, and the article separately notes large-scale credential attacks on Fortinet VPN appliances generating tens of millions of authentication failures.

The Hacker Newsupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Hackers Exploit Critical Cisco Secure Email Gateway Vulnerability in the Wild to Run Malicious Code

Cisco warns attackers actively exploit zero-day CVE-2026-76461 in Secure Email Gateway, gaining unauthenticated root command execution via crafted emails.

Cisco PSIRT confirmed active in-the-wild exploitation of CVE-2026-76461 throughout September 2026, a zero-day in Secure Email Gateway AsyncOS that lets remote, unauthenticated attackers execute arbitrary commands with root privileges by sending maliciously crafted emails containing injected SQL statements. Physical appliances, virtual deployments, and Cisco Secure Email Cloud instances were affected; Cisco deployed server-side remediations for cloud tenants but on-premises admins must patch themselves. Fixes ship in AsyncOS 16.5.0-780 plus branches 16.0.4-3021 and 15.5.5-0141, and no workarounds exist.

Cyber Security Newsupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) to KEV; federal agencies must patch by September 17, 2026.

CISA added CVE-2026-76461 (CVSS 9.8), a critical zero-day in Cisco AsyncOS for Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities catalog. The flaw stems from insufficient validation in email parsing, letting an unauthenticated remote attacker send a crafted email with malicious SQL statements to achieve arbitrary command execution with root privileges. Cisco confirmed active exploitation in the wild, notes no workarounds exist, and recommends checking mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM' on every cluster device. Under BOD 22-01, FCEB agencies must remediate by September 17, 2026.

Security Affairsupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Critical Cisco Secure Email Gateway zero-day gives attackers root access

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.

CSO Onlineupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461CVE-2025-203932

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) enables unauthenticated root command execution via crafted email; CISA added it to KEV.

CVE-2026-76461 is a critical SQL injection (CVSS 9.8) in Cisco AsyncOS for Secure Email Gateway allowing an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a specially crafted email through a vulnerable gateway. CISA added it to the KEV catalog on disclosure day, indicating zero-day exploitation, and Cisco PSIRT became aware of active exploitation in September 2026. No public PoC or attribution exists; fixed versions are 15.5.5-014, 16.0.4-302, and 16.5.0-780, and admins should check mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM'.

Rapid7 Blogupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-764611

Cisco security advisory (AV26-921)

Canadian Cyber Centre warns actively exploited Cisco Secure Email Gateway SQL injection CVE-2026-76461 was added to CISA's KEV database.

The Canadian Centre for Cyber Security advisory AV26-921 (September 14, 2026) covers a SQL injection vulnerability in Cisco Secure Email Gateway (AsyncOS) and Secure Email and Web Manager. Affected versions include AsyncOS/Secure Email Gateway prior to 15.5.5-014, 16.0.4-302, and 16.5.0-780, and Secure Email and Web Manager prior to 15.5.5-006 and 16.5.0-429. Cisco stated CVE-2026-76461 is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities database the same day. Users and administrators are urged to apply updates as they become available.

Canadian Centre for Cyber Securityupdated · 2d agofirst · 3d agoAdvisory in the wild 17 sourcesCVE-2026-764611

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)

Cisco Talos confirms nation-state (Sandworm) and ransomware (Qilin) actors actively exploit CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center.

CVE-2026-20079 is a critical unauthenticated authentication bypass in the FMC web interface allowing root-level script and command execution via crafted HTTP requests; CVE-2026-20316 stems from static hard-coded credentials enabling unauthenticated logins. Cisco Talos detailed three intrusion clusters: web shell and JAR deployment for credential theft, a Sandworm-attributed reverse shell and credential-harvesting implant, and a suspected Qilin ransomware operator chain. Cisco urges immediate hotfixes ahead of a comprehensive hardening release the week of September 16, or taking the FMC management interface offline.

Help Net Security · 8d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316

Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0

Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0, found internally with no exploitation observed.

Cisco released fixes for four Crosswork platform vulnerabilities including CVE-2026-20030 SQL injection and CVE-2026-20357 missing authentication, both scoring CVSS 10.0, affecting Crosswork Release 7.2.1 and earlier. Five additional flaws in Secure Workload, including CVE-2026-20315 and CVE-2026-20317 at CVSS 10.0, affect SaaS and on-premises deployments up to releases 3.10 and 4.0. All issues were found through internal testing and are not known to be actively exploited. The patches follow a broader internal security review that recently addressed 12 Catalyst SD-WAN and IOS XE bugs.

The Hacker News · 28d agoVulnerabilityCVE-2026-20030CVE-2026-20357CVE-2026-20358+7 CVEs

CISA Warns of Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

CISA added actively exploited Cisco Secure Email Gateway SQL injection flaw CVE-2026-76461 to its KEV catalog, enabling unauthenticated root command execution.

CVE-2026-76461 is an unauthenticated SQL injection (CWE-89) in Cisco AsyncOS for Cisco Secure Email Gateway appliances, allowing remote attackers to execute arbitrary OS commands with root privileges. CISA added the flaw to the KEV catalog on September 14, 2026, requiring federal civilian agencies to apply vendor mitigations by September 17, 2026, and forensic triage under BOD 26-04. A compromised gateway could let attackers alter email security policies, access stored messages, disable logging, and pivot into enterprise networks.

Cyber Security Newsupdated · 2d agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.

Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.

Security Affairsupdated · 2d agofirst · 3d agoExploit / PoC in the wild 17 sourcesCVE-2026-764617· 2 reads

Hackers Exploit Critical Cisco Firewall Flaw to Gain Root Access and Deploy Malware

State-sponsored and ransomware actors actively exploit critical Cisco FMC flaws CVE-2026-20079 (CVSS 10.0) and CVE-2026-20316 to gain root access and deploy ransomware.

Cisco Talos confirmed in-the-wild exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated authentication bypass enabling root command execution) and CVE-2026-20316 (CVSS 5.3, hard-coded static credentials) in Cisco Secure Firewall Management Center. Three activity clusters were identified: UAT-12197 dropping a JSP web shell and credential harvester; UAT-11823, assessed as Sandworm, deploying a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate chaining the flaws before deploying ransomware. CISA added both CVEs to the KEV catalog with a September 12 remediation deadline for federal agencies.

Cyber Security News · 8d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber Security · 15d agoAdvisory