#cisco
-
CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog
The U.S. agency CISA has added a critical GitLab flaw enabling remote code execution and a Cisco firewall bug leading to denial of service to its catalog of known exploited vulnerabilities.
-
Cisco patches actively exploited zero-day in ASA and FTD firewalls
CVE-2026-76418 lets unauthenticated remote attackers force Cisco firewalls with SSL VPN enabled to reload. The company has already seen attacks and urges customers to update.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Cisco Patches New Actively Exploited Secure Email Gateway Zero-Day
A flaw in the gateway's malware-protection feature let remote, unauthenticated attackers run commands as root. Cisco says it saw the bug exploited in the wild in October 2026.
-
Cisco patches fifth SD-WAN Manager zero-day of the year amid active attacks
A critical authentication-bypass flaw, CVE-2026-76504, lets an unauthenticated attacker gain admin rights on Catalyst SD-WAN Manager. Cisco has confirmed active exploitation and shipped fixes.
-
Cisco Fixes a Critical 0-Day in Identity Services Engine Already Being Used in Attacks
The CVE-2026-76460 vulnerability allows authentication to be bypassed via the API and grants access to the device without credentials. Cisco and CISA strongly urge installing the updates immediately.
-
Critical Cisco Secure Email Gateway Vulnerability Exploited in Attacks
Cisco has warned of active exploitation of CVE-2026-76461, rated 9.8, which allows remote command execution with root privileges through a specially crafted email.
-
Cisco Confirms Exploitation of Critical Secure FMC Vulnerability
The CVE-2026-20079 vulnerability, with a maximum CVSS score of 10.0, allows attackers to bypass authentication and execute commands with root privileges. Cisco has acknowledged that it is already being used in attacks, and CISA has ordered government agencies to remediate the flaw by September 12.
-
Critical Cisco Nexus 9000 Flaw Enables Remote Code Execution With Root Privileges
Cisco has released patches for a critical hole in its Silicon One–based Nexus 9000 switches that lets an unauthenticated attacker execute code with root privileges. At the same time, a “hardening” release of IOS XR went out, closing seven CVEs, two of them rated 9.8.
-
Fire Ant Moves From Hypervisors to Cisco Routers
The Chinese cyber-espionage group Fire Ant is hijacking Cisco IOS XR routers, TACACS servers and Linux hosts, turning them into platforms for intercepting traffic and stealing credentials while blinding defenders' monitoring tools along the way.
-
Cisco Fixes Nine Vulnerabilities in Crosswork and Secure Workload, Five Rated 10.0
The company has released a fresh batch of patches for the Crosswork and Secure Workload platforms following an internal security audit. Five of the nine holes received the maximum CVSS score of 10.0.
-
Cisco Warns of Active Exploitation of a Flaw in ASA and FTD
A vulnerability in the VPN components of Cisco Secure Firewall lets attackers reboot devices remotely. The company has observed attacks and released fixes.
-
Cisco: Embedded Credentials in Secure FMC Used in Zero-Day Attacks
Cisco is warning of active exploitation of CVE-2026-20316 in Secure Firewall Management Center, caused by static credentials hardcoded into the software. Patches have already been released, and there are no workarounds.