55
55
60
60
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.
Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.
85
60
60
60
55
60
60
55
55
60
60
55
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
Cisco confirms zero-day CVE-2026-76460 (CVSS 10.0) in ISE is under active exploitation, granting unauthenticated root command execution; patches released.
Cisco's PSIRT issued an urgent advisory for CVE-2026-76460, an authentication bypass via insufficient controls on an API endpoint in Cisco ISE and ISE-PIC, confirmed to be actively exploited with a CVSS score of 10.0. Exploitation can yield root-level command execution, enabling persistence, credential theft, and lateral movement from the network policy platform. Fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4; EOL version 3.0 requires migration, and iACLs offer only temporary mitigation. The flaw was discovered while resolving a TAC support case, and Cisco provides hunting guidance including access.log review and firewall log analysis.
86
Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access
Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.
Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.
78
Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root
Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.
Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.
78
60
55
60
60
60
60
60
60
Veeam Intelligent Data Management combines with Cisco HyperFlex to deliver new Availability solution
55
Cisco warns customers of actively exploited zero-day in email gateways
Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.
Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.
92
60
60
60
60
60
55
60
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.
Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.
88
60
60
U.S. CISA adds Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
60