#Cisco
All CosmicBytez Labs articles tagged #Cisco, across news, security advisories, how-to guides, and projects.
- News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco warns attackers are actively exploiting CVE-2026-76504, a critical 9.8 CVSS auth bypass granting admin API access to SD-WAN Manager.
- News
InfraTrust Report Warns Network Management Systems Under Attack
Eclypsium's InfraTrust Pulse finds 158 advisories across 17 vendors as attackers target network management consoles before or at disclosure.
- News
Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Surge & Browser Hijacks
This week: a maximum-severity Cisco ISE bypass, an AI agent chaining bugs into OpenAI, a Cloudflare-key ClickFix worm, and bank browser hijacks.
- News
Cisco Zero-Day Highlights API Endpoint Authentication Issues
CVE-2026-76460, a maximum-severity CVSS 10.0 auth bypass in Cisco ISE, is under active exploitation and now sits in CISA's KEV catalog.
- News
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco patches CVE-2026-76460, a CVSS 10.0 ISE auth bypass exploited in the wild; CISA gives federal agencies until Sept. 19 to patch.
- News
Cisco Patches 44 Vulnerabilities Across FMC, ISE, and Nexus Dashboard
Cisco patches 44 flaws across FMC, ISE, and Nexus Dashboard, including root-access and RCE bugs; two FMC CVEs were already exploited since August.
- News
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns of an actively exploited CVSS 10.0 auth bypass in ISE (CVE-2026-76460); CISA added it to KEV with a Sep 19 deadline.
- Security
CVE-2026-20284: SQL Injection in Cisco ISE SXP REST API
Authenticated SQL injection in Cisco ISE's SXP REST API (CVSS 9.1) lets admins view, modify, or crash the ISE policy database.
- News
Cisco Warns Customers of Actively Exploited Zero-Day in Email Gateways
Cisco confirms CVE-2026-76461, a critical unauthenticated SQL injection in Secure Email Gateway, was exploited as a zero-day before patches shipped.
- News
Cisco Secure Email Gateway Zero-Day Exploited to Execute Root Commands
CVE-2026-76461 (CVSS 9.8) lets attackers send crafted emails with malicious SQL to gain root RCE on Cisco Secure Email Gateway; CISA gives feds 3 days.
- Newsletter
Weekly Digest — Issue #35
Cisco's email gateway gets root-RCE'd via crafted SQL, GitLab ships a perfect 10.0 path traversal, and China chains three zero-days to backdoor NGOs.
- Security
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Secure Email Gateway has a critical, unauthenticated SQL injection (CVSS 9.8) enabling root code execution. CISA KEV-listed as actively exploited.
- News
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Three threat clusters, including a state-sponsored actor, are exploiting two Cisco FMC flaws to steal credentials and deploy Qilin ransomware.
- News
Cisco Warns of ASA and FTD VPN Flaw Actively Exploited to Crash Firewalls
CVE-2026-20349 (CVSS 8.6) in Cisco ASA and FTD allows unauthenticated remote attackers to crash SSL VPN devices via crafted HTTP requests — no workaround...
- Security
CVE-2026-20349: Cisco ASA and FTD Heap Inspection Vulnerability
Cisco Secure Firewall ASA and FTD contain a heap inspection vulnerability allowing unauthenticated remote attackers to crash devices and trigger a denial...
- News
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
CISA has added a newly disclosed Cisco Secure Firewall Management Center zero-day to its Known Exploited Vulnerabilities catalog following confirmed...
- Security
CVE-2026-20316: Cisco FMC Hardcoded Password Gives Unauthenticated Remote Access
A hardcoded static credential in Cisco Secure Firewall Management Center allows unauthenticated remote attackers to log in and access sensitive data. CISA...
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- Security
CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco IOS 12.4 contains multiple CSRF vulnerabilities that allow remote attackers to execute arbitrary commands. The flaw has been added to the CISA Known...
- News
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos researchers have identified new LONGLEASH malware deployed by Chinese APT group UAT-7810 to expand its Operational Relay Box network,...
- News
Hackers Exploit Cisco SD-WAN Zero-Day for Root Access at Telecom Provider
Mandiant has detailed an incident in which threat actors exploited a Cisco SD-WAN zero-day vulnerability to gain the highest possible access level at a...
- News
CISA Sets Urgent Deadline to Fix Cisco Flaw Actively Exploited in Attacks
CISA has added a Cisco Unified Communications Manager Server vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to...
- News
Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions
Cisco has acquired Astrix Security and WideField to build out non-human identity (NHI) protection capabilities, betting that securing AI agents, service...
- News
Mandiant Reveals How Cisco SD-WAN Zero-Day CVE-2026-20245 Gained Root Access
Mandiant's post-incident analysis exposes a sophisticated multi-stage attack chain that exploited CVE-2026-20245 to plant a hidden root account on Cisco...
- News
CVE-2026-20230: Cisco Unified CM WebDialer SSRF Now Exploited in the Wild
Cisco Unified Communications Manager and SME are under active attack via CVE-2026-20230, a high-severity SSRF flaw in the WebDialer component that can...
- Security
CVE-2026-20262: Cisco Catalyst SD-WAN Manager Path Traversal Vulnerability
Cisco Catalyst SD-WAN Manager contains a directory path traversal vulnerability allowing an authenticated remote attacker to create or overwrite any file...
- News
Cisco Customers Encounter Another SD-WAN Zero-Day Under Attack
A seventh actively exploited zero-day in Cisco SD-WAN products this year — CVE-2026-20245 — is under attack with no patch yet available from Cisco.
- News
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
- News
Cisco Warns of Unpatched SD-WAN Zero-Day Exploited in Attacks
Cisco has issued an emergency warning about an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that enables root…
- Security
CVE-2026-20223: Cisco Secure Workload REST API Auth Bypass
A CVSS 10.0 authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to access internal REST APIs with full Site Admin privileges.
- News
Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco
This week's cybersecurity landscape opened with a critical Microsoft Exchange spoofing zero-day under active exploitation, a coordinated npm/PyPI supply...
- News
Cisco Catalyst SD-WAN Controller Auth Bypass Actively
Cisco has patched a maximum-severity authentication bypass flaw in its Catalyst SD-WAN Controller that has already been exploited in limited attacks....
- News
Cisco Patches Another SD-WAN Zero-Day, the Sixth Exploited
Cisco has patched CVE-2026-20182, a zero-day in Catalyst SD-WAN Manager that has been actively exploited in targeted attacks by sophisticated threat actor...
- News
Cisco Zero-Day Under Ongoing Attack by Persistent Threat
The threat group UAT-8616 is actively exploiting a new Cisco SD-WAN zero-day and has been linked to multiple prior Cisco firewall and SD-WAN vulnerability...
- News
In Other News: Big Tech vs Canada Encryption Bill, Cisco's
Other noteworthy stories this week: Big Tech firms push back against Canada's encryption legislation, Cisco releases a free AI security specification, and...
- Security
CVE-2026-20182: Cisco Catalyst SD-WAN Controller
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass...
- News
Cisco Releases Open Source Tool for AI Model Provenance
Cisco has released a new open source toolkit designed to track and verify the provenance of AI models throughout the supply chain, addressing risks from...
- News
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device
CISA and the UK's NCSC have revealed that a US federal civilian agency's Cisco Firepower device running ASA software was compromised in September 2025...
- News
Firestarter Malware Survives Cisco Firewall Updates and Security Patches
US and UK cybersecurity agencies are warning about Firestarter, a custom implant that persists on Cisco Firepower and Secure Firewall devices running ASA...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- Security
CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use
Cisco Catalyst SD-WAN Manager contains a privileged API misuse vulnerability that allows an attacker to upload a malicious file to the local file system...
- News
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco has released security advisories addressing a batch of critical and high-severity vulnerabilities across multiple products, covering flaws that...
- News
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts
A large-scale credential harvesting campaign has been observed exploiting the React2Shell vulnerability (CVE-2025-55182) as an initial infection vector,...
- News
Cisco Source Code Stolen in Trivy-Linked Dev Environment
Cisco has suffered a major cyberattack after threat actors leveraged stolen credentials from the recent Trivy supply chain compromise to breach its...
- News
Interlock Ransomware Exploited Cisco FMC Zero-Day for 36
CVE-2026-20131, a maximum-severity CVSS 10.0 insecure deserialization flaw in Cisco Firepower Management Center, was exploited by Interlock ransomware as...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- News
Interlock Ransomware Has Been Exploiting Cisco FMC Zero-Day
The Interlock ransomware gang has been actively exploiting a CVSS 10.0 insecure deserialization flaw in Cisco Secure Firewall Management Center since late...
- Newsletter
Mar 6 Digest: 90 Zero-Days in 2025, Cisco CVSS 10
This week: Google reports 90 zero-days exploited in 2025 with enterprise tech at 48%, CISA issues emergency directive for Cisco SD-WAN CVSS 10 zero-day,...
- Security
CISA Issues Emergency Directive as Cisco SD-WAN Zero-Day
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) has been actively exploited by threat actor UAT-8616 since...
- Security
Cisco SD-WAN Zero-Day CVE-2026-20127 Triggers Five Eyes
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN has been exploited since at least 2023. CISA issues Emergency Directive ED 26-03 as all Five...
- Security
Cisco Unified Communications Zero-Day Exploited for Root RCE
An actively exploited zero-day in Cisco Unified Communications allows unauthenticated remote code execution with root privileges via crafted HTTP...
- Security
Cisco IOS XE Web UI Privilege Escalation Actively Exploited
Cisco discloses a high-severity privilege escalation vulnerability in IOS XE Web UI that allows authenticated users to gain root access. Active...
- News
Cisco Patches Critical Webex Vulnerability Allowing Remote
Cisco has released emergency patches for a critical vulnerability in Webex that could allow unauthenticated remote code execution. Organizations urged to...