ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Cisco products”

20 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 21Industry 6Advisory 6Tools 3Vulnerability 2AI industry 2Phishing & fraud 1
SeverityAllcritical 22high 7medium 0low 1info 11

Critical Cisco Secure Email Gateway zero-day gives attackers root access

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.

CSO Onlineupdated · 22h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461CVE-2025-203931

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.

CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.

BleepingComputer · 5h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-76423CVE-2026-20176+4 CVEs1· 1 read

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

Cisco's September 2026 firewall hardening release fixes internally found ASA, FTD, and FMC flaws, two of which are actively exploited.

Cisco released September 2026 hardening updates for Secure Firewall ASA, FTD, and FMC software addressing multiple vulnerabilities discovered during a comprehensive internal security review. Two of the vulnerabilities are known to be actively exploited, including a Cisco Secure Firewall Management Center static credential vulnerability. Details are provided in separate linked advisories.

Cisco Security Advisories · 20h agoAdvisory in the wild 6 sources

Cisco Nexus Dashboard Software Security Hardening Release: September 2026

Cisco released Nexus Dashboard hardening updates for multiple internally discovered vulnerabilities, grouped by CWE and not known to be exploited.

Cisco's Nexus Dashboard engineering team conducted an internal security review that found multiple vulnerabilities, addressed via software hardening releases. The issues were discovered during internal testing and are not known to be actively exploited. Cisco grouped the issues by CWE class and assigned a single CVE ID per issue before releasing fixes.

Cisco Security Advisoriesupdated · 37m agofirst · 20h agoAdvisory 2 sources

Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026

Cisco's September 2026 hardening release for Secure Email Gateway and Secure Email and Web Manager patches internally found flaws, one actively exploited.

Cisco issued a security hardening release for Cisco Secure Email Gateway and Secure Email and Web Manager covering multiple internally discovered vulnerabilities, grouped by CWE class to streamline patching. Cisco states one of the vulnerabilities is known to be actively exploited. The exploited issue is the Cisco Secure Email Gateway SQL Injection Vulnerability detailed in a companion advisory. Software updates are available.

Cisco Security Advisories · 2d agoAdvisory in the wild6

Cisco drops another exploited zero-day, this time a perfect 10new

Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.

Cisco disclosed CVE-2026-76460 (CVSS 10.0), an authentication bypass in Identity Services Engine (ISE) and ISE-PIC APIs that gives unauthenticated remote attackers command execution with root privileges; CISA added it to the KEV catalog. It follows CVE-2026-76461 (CVSS 9.8), an actively exploited flaw in Cisco Secure Email Gateway and Secure Email and Web Manager disclosed days earlier. Permanent fixes ship in ISE 3.1 Patch 12 through 3.5 Patch 4; ISE 3.0 is end-of-maintenance and ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4 are available. No workaround exists, though ACLs restricting management traffic can serve as temporary mitigation.

The Register · Security · 14m agoExploit / PoC in the wild 21 sourcesCVE-2026-76460CVE-2026-76461

AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060

Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.

The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet: CVE-2026-67277 (missing authentication, CWE-306, enabling sensitive information disclosure), CVE-2026-86060 (argument injection, CWE-88, enabling privilege escalation), and CVE-2026-67276 (improper cryptographic signature verification, CWE-347, allowing SSH command channel access without the private key). On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.

Canadian Centre for Cyber Securityupdated · 6d agofirst · 6d agoVulnerability in the wild 2 sourcesCVE-2026-67276CVE-2026-67277CVE-2026-860603· 2 reads

Only at TechCrunch Disrupt 2026: What happens when OpenAI ships your roadmap?

TechCrunch Disrupt 2026 panel will discuss AI startup defensibility when OpenAI, Anthropic, or Google ship features startups built.

TechCrunch promotes a Builders Stage session at Disrupt 2026 (October 13-15, Moscone West, San Francisco) titled 'What Happens When OpenAI Ships Your Roadmap.' Speakers include Airbyte CEO Michel Tricot, Radical Ventures partner Rob Toews, and Webflow CEO Linda Tong. The session examines how founders differentiate when foundation model providers absorb startup capabilities, emphasizing proprietary data, embedded workflows, customer relationships, and trust as remaining moats.

TechCrunch · AI · 2d agoAI industry1

12 Best Kubernetes Security Tools Compared (2026): Features & Pricing

GBHackers compares 12 Kubernetes security vendors including Sysdig, Wiz, Aqua, and Cisco Isovalent on features, pricing units, and procurement strategy.

GBHackers publishes a 2026 buying guide comparing 12 Kubernetes security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, Snyk, Cisco Isovalent, Palo Alto Networks, Fairwinds, Red Hat ACS, and Tigera. It argues CNCF-grade open source (Kubescape, Falco, Trivy, Calico, Cilium/Tetragon) provides free posture, runtime, and network policy coverage that resets price negotiations. Cisco's acquisition of Isovalent places the eBPF data plane under a networking giant, while the paid market focuses on multi-cluster policy, enforcement, and support. The piece emphasizes that pricing units (workload, node, cluster, developer, credits) heavily influence contract costs.

GBHackersupdated · 4h agofirst · 1d agoTools 12 sources1

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talos · 6d agoIndustry in the wild1

U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Cisco FMC, Chrome V8, Fortinet and Citrix NetScaler flaws to its KEV catalog, ordering federal patching by September 12.

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-20079 (CVSS 10.0) is an unauthenticated authentication bypass in Cisco Secure Firewall Management Center's web interface enabling script execution and potential root access. CVE-2026-87491 (CVSS 8.8) is an out-of-bounds write in Chrome's V8 engine — the seventh actively exploited Chrome zero-day of 2026 — fixed in Chrome 153.0.8010.36. CVE-2025-25249 (CVSS 8.1) is a heap-based buffer overflow in FortiOS/FortiSwitchManager's cw_acd daemon being exploited with the PivotC2 RAT, and CVE-2026-19490 (CVSS 9.3) is a NetScaler SAML HTTP-Redirect authentication bypass; federal agencies must patch by September 12, 2026.

Security Affairsupdated · 3h agofirst · 6d agoExploit / PoC in the wild 3 sourcesCVE-2025-25249CVE-2026-19490CVE-2026-87491+1 CVEs1

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security · 4d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News · 2d agoTools

Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.

Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.

BleepingComputerupdated · 3d agofirst · 6d agoExploit / PoC in the wild 6 sourcesCVE-2026-20079CVE-2026-203161

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.

Oracle released 673 new security patches in its September 2026 Critical Security Patch Update, resolving 672 unique CVEs across 17 risk matrices plus 130+ additional CVEs. More than 100 flaws are critical severity and over 240 are remotely exploitable without authentication. Oracle E-Business Suite received the largest batch with 159 patches, followed by Fusion Middleware (153, including 78 unauthenticated remote flaws) and Hyperion (102). Oracle reports no exploitation of these specific flaws but warns attackers routinely exploit unpatched Oracle products.

SecurityWeekupdated · 17h agofirst · 1d agoAdvisory 3 sources

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeekupdated · 21h agofirst · 1d agoExploit / PoC in the wild 3 sourcesCVE-2026-54302· 1 read

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · Security · 6d agoPhishing & fraud in the wild1

America’s cyber strategy overlooks the infrastructure that actually keeps the military moving

Op-ed argues US cyber strategy underweights Iranian threats to ports, rail, utilities and other commercial infrastructure sustaining military operations.

The author, a former Navy intelligence officer, argues that a prolonged Iran conflict means sustained Iranian cyber operations targeting many smaller systems like water utilities, manufacturers and transportation providers. He cites mapping of 130 documented techniques across five Iranian threat groups and warns destructive attacks such as wipers and ransomware could hit the defense industrial base. The piece urges defensive wargames now and flags the pause in CMMC implementation as particularly concerning.

CyberScoop · 2h agoIndustry

NVIDIA Vera Rubin NVL72 Delivers Leading Performance in MLPerf Inference v6.1 Debut

NVIDIA's Vera Rubin NVL72 debuts in MLPerf Inference v6.1 with up to 3.7x higher throughput than GB300 NVL72 and 99% scaling efficiency at 288 GPUs.

In its first MLPerf Inference preview submission, NVIDIA's Vera Rubin NVL72 achieved up to 3.7x higher throughput than GB300 NVL72 on Qwen3-VL and 2.5x on DeepSeek-R1. A 288-GPU GB300 NVL72 submission across four racks reached 99% scaling efficiency on the DeepSeek-R1 offline benchmark. Software optimizations delivered up to 1.6x gains over v6.0, leveraging TensorRT-LLM, vLLM, Dynamo, disaggregated serving, and NVFP4 precision.

NVIDIA Blog · 21h agoAI industry 2 sources

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers · 2d agoIndustry in the wild