60
50
60
60
60
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass enabling unauthenticated root command execution in Secure FMC; CISA added it to KEV.
Cisco confirmed in August 2026 that CVE-2026-20079 (CVSS 10.0), an unauthenticated authentication bypass in Secure Firewall Management Center, is being actively exploited, allowing remote attackers to execute scripts and commands as root via crafted HTTP requests to the web interface. CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to patch by September 12, 2026. Shared IOCs, identical hot fixes, and a July 23 log entry suggest CVE-2026-20079 was used alongside the separately exploited static-credential flaw CVE-2026-20316 in the same attacks. Cisco released patches and cloud fixes, warns hot fixes do not remediate already-compromised devices, and says there are no workarounds.
85
60
60
U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
60
60
60
60
3 0Day in SonicWall Enterprise Email Security products actively exploited
60
60
60
60
60
Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day
Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.
Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.
93
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.
Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.
90
Fortinet security advisory (AV26-023) - Update 1
CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.
The Canadian Centre for Cyber Security updated advisory AV26-023, which relays January 2026 Fortinet advisories covering FortiFone, FortiOS, FortiSASE, FortiSIEM, and FortiSwitchManager. On September 9, 2026, CISA added CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its Known Exploited Vulnerabilities catalog. Related Fortinet flaws include unauthenticated local configuration access (CVE-2025-47855) and unauthenticated remote command injection (CVE-2025-64155). Administrators should review the advisories and apply available updates.
60
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.
90
Cisco fixes vulnerability exploited to DoS its firewalls (CVE-2026-20349)
Cisco patches CVE-2026-20349, a high-severity unauthenticated DoS in ASA and FTD VPN services now added to CISA's KEV.
CVE-2026-20349 affects the Remote Access SSL VPN service in Cisco Secure Firewall ASA and FTD software, where specially crafted unauthenticated HTTP requests can cause appliances to reload, creating a denial of service. Cisco confirmed active exploitation observed in August 2026 and released hot fixes for ASA versions 9.16 through 9.24 and FTD versions 7.0 through 10.0. The flaw was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for US civilian federal agencies. No workarounds or indicators of compromise are available.
76
60
60
60
60
Cisco Confirms Active Exploitation of Two Catalyst SD
60
60
60
60
60
U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog
60
60