Loading story…
Cisco released emergency fixes for more than 20 vulnerabilities across Identity Services Engine (ISE/ISE-PIC), Secure Firewall Management Center (FMC), Nexus Dashboard, and Secure Firewall ASA/FTD. Five flaws carry a maximum CVSS 10.0 rating: FMC vulnerability CVE-2026-20079 allows unauthenticated remote attackers to send crafted HTTP requests and gain root privileges, while CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, and CVE-2026-76460 in ISE can permit authentication bypass, privileged administrative or system access, and in some cases code execution. A successful FMC compromise could allow attackers to modify firewall policies or disable security controls.
Cisco reports active exploitation of flaws in FMC and ISE, and CISA added the ISE privileged-API vulnerability CVE-2026-76460 to its Known Exploited Vulnerabilities catalog. Active exploitation has also been reported for ASA/FTD vulnerabilities CVE-2026-20329 and CVE-2026-20330. No workarounds are available; organizations should urgently upgrade to Cisco's fixed releases and restrict management interfaces to trusted networks while patching. ISE 3.0 and earlier are unsupported and must first be upgraded to a supported version before fixes can be applied.
See which actors are running it and whether you're in range.
21 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued Alert AL26-021 on vulnerabilities CVE-2026-20192, CVE-2026-76423, and actively exploited CVE-2026-76460 affecting Cisco ISE and ISE-PIC. The alert detailed authentication-bypass and administrative-access risks, identified fixed releases, and advised urgent remediation and re-imaging of potentially compromised nodes.
The Canadian Centre for Cyber Security published advisory AV26-932 covering vulnerabilities affecting Cisco FTD, FMC, ISE, ISE-PIC, Nexus Dashboard, and ASA products. The advisory directed organizations to review Cisco security advisories and apply available updates, while noting CISA's addition of CVE-2026-76460 to KEV.
Cisco published patches for CVE-2026-20322, CVE-2026-20325, CVE-2026-20326, CVE-2026-20360, CVE-2026-20361, and CVE-2026-76409 in Nexus Dashboard. CVE-2026-20322 can be exploited over the network and is rated for high confidentiality, integrity, and availability impact.
Cisco disclosed and released updates for six independent ISE and ISE-PIC vulnerabilities, CVE-2026-76423 through CVE-2026-76428. The most severe, CVE-2026-76423, is a CVSS 10.0 unauthenticated REST API authorization-bypass flaw that can grant remote administrative access; Cisco said no workarounds were available.
Cisco disclosed and released fixes for CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, and CVE-2026-76427 in ISE and, for one issue, ISE-PIC. Authenticated administrators could exploit the flaws for root command execution via file upload, SQL database access, arbitrary file reading, or SSRF; no public exploits were known.
Cisco published fixes for SQL-injection vulnerabilities CVE-2026-20247 and CVE-2026-20300 in Cisco Identity Services Engine. CVE-2026-20247 is network-accessible, requires no authentication or user interaction, and can cause high integrity impact; no known exploits were reported.
Cisco disclosed and released updates for CVE-2026-20307, a CVSS 9.9 insecure Java deserialization vulnerability in Cisco ISE's web management interface. An authenticated attacker with low-privileged administrative credentials could execute arbitrary code and escalate to root; Cisco said no workaround is available.
Cisco published fixes for CVE-2026-20176, an input-validation flaw in Cisco ISE that allows authenticated high-privileged administrators to execute operating-system commands via crafted HTTP requests. Exploitation can provide system-level access and potential root elevation, and may make single-node ISE deployments unavailable; no public exploits were known.
Cisco published an advisory and fixes for CVE-2026-20211, an insecure Java deserialization vulnerability in Cisco ISE that allows authenticated high-privileged administrators to execute commands on the underlying operating system. Exploitation can yield user-level OS access with possible elevation to root and can make a single-node deployment unavailable; no known exploits were reported.
Cisco published patches for CVE-2026-20282, CVE-2026-20283, and CVE-2026-20284 in Cisco ISE. The flaws can permit operating-system write access, IPsec Open API command injection, or SXP REST API SQL injection to authenticated administrators; no public exploits were known.
Cisco published an advisory and patch for CVE-2026-20305, a CVSS 8.8 command-injection vulnerability in Cisco Identity Services Engine. Exploitation is network-accessible and requires high privileges; the Nessus plugin reported no known exploits.
CISA added CVE-2026-76460, a CVSS 10.0 Cisco ISE privileged-API vulnerability that can provide unauthenticated full system access, to its Known Exploited Vulnerabilities catalog, indicating active exploitation.
Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication-bypass flaw in Cisco ISE and ISE-PIC that was actively exploited and could ultimately allow root command execution. Cisco released fixed patches for supported releases and said no complete workaround was available.
Cisco disclosed CVE-2026-76461, a CVSS 9.8 vulnerability under active exploitation affecting Secure Email Gateway and Secure Email and Web Manager appliances. Successful exploitation can result in root access.
Cisco released coordinated September 2026 updates addressing more than 20 vulnerabilities in ISE/ISE-PIC, FMC, Nexus Dashboard, and ASA/FTD software. The release included four CVSS 10.0 ISE flaws and fixed FMC and Nexus Dashboard issues; Cisco said no workarounds were available.
Cisco stated that CVE-2026-20079 and CVE-2026-20316, vulnerabilities in the same class as CVE-2026-20332, had been exploited in the wild since August 2026.
The critical unauthenticated remote vulnerability CVE-2026-20079 affecting Cisco Secure Firewall Management Center was known by March 2026. Crafted HTTP requests can yield root privileges on vulnerable FMC systems.
Cisco remediated 41 additional critical vulnerabilities affecting ISE and ISE-PIC, including flaws enabling command execution, authentication and authorization bypass, remote code execution, SQL injection, XXE, and sensitive-information exposure. Cisco advised affected organizations to upgrade to fixed patch levels, limit access to trusted sources, and review logs for suspicious activity.
Cisco reported active exploitation in the wild of CVE-2026-20329 and CVE-2026-20330, two CVSS 9.9 vulnerabilities affecting Cisco ASA and FTD software.
Cisco recommended reviewing Kong API Gateway logs on all ISE nodes for suspicious usernames such as "dummyuser" and correlating findings with perimeter logs. For suspected exploitation of CVE-2026-76460, Cisco advised isolating and re-imaging affected nodes and restoring known-good configurations rather than merely applying the patch.
Cisco reported that attackers were exploiting vulnerabilities in Secure Firewall Management Center and Identity Services Engine, including critical issues that can permit root or administrative access, authentication bypass, or code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
49 references tracked. Mallory keeps watching after this page renders.
triskelelabs.com
Open sourcecsirt.bj
Open sourcecsirt.sk
Open sourcethecyberexpress.com
Open sourcecwe.mitre.org
Open sourcebst.cloudapps.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourcebst.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities have been discovered in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) WebVPN components, which are being actively exploited in the wild. The vulnerabilities, identified as CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, allow attackers to bypass authentication and achieve remote code execution (RCE) as root on affected devices. CVE-2025-20362 is an unauthenticated authorization bypass that enables attackers to access restricted endpoints without valid credentials, serving as a key component in exploit chains. When combined with CVE-2025-20333, attackers can send malicious HTTPS requests to execute arbitrary code as root, even without prior authentication. CVE-2025-20363 is a related flaw that also enables unauthenticated RCE on ASA/FTD devices and authenticated RCE on some Cisco IOS components. These vulnerabilities affect Cisco ASA versions 9.16 through 9.23 and Cisco FTD versions 7.0 through 7.7, with specific software images requiring validation against Cisco advisories. Cisco and CISA have confirmed active exploitation and widespread scanning for these vulnerabilities, prompting CISA to issue Emergency Directive 25-03 on September 25, 2025, mandating immediate action by federal agencies. The threat actor responsible for these attacks is attributed to the same group behind the ArcaneDoor (UAT4356) state-sponsored espionage campaign first observed in 2024. Organizations are urged to patch or upgrade to Cisco’s fixed releases without delay, and to restrict or disable vulnerable devices if immediate upgrades are not possible. Compromised devices should be isolated and thoroughly investigated for signs of threat actor presence. Cisco has provided detailed guidance for detection, and CISA’s Malware Next Generation tool can be used to hunt for indicators of compromise. Security researchers, including Rapid7, have published technical analyses and exploit chains demonstrating the severity and ease of exploitation. The vulnerabilities are considered highly critical due to their unauthenticated nature and the potential for full device compromise, which could lead to further lateral movement within affected networks. The rapid response from both Cisco and CISA underscores the urgency and scale of the threat. Organizations using Cisco ASA or FTD devices should assume exposure if running affected versions and prioritize remediation. The vulnerabilities highlight the ongoing targeting of network edge devices by sophisticated threat actors, particularly those engaged in espionage. Failure to address these vulnerabilities could result in significant operational disruption and data compromise. The security community continues to monitor for new exploitation techniques and advises ongoing vigilance. The release of proof-of-concept code and active scanning increases the risk of opportunistic attacks by additional threat actors. Timely patching and adherence to Cisco and CISA recommendations are essential to mitigate risk from these critical vulnerabilities.
Jun 29, 2026
Cisco has disclosed multiple critical zero-day vulnerabilities affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software, which are actively being exploited in the wild. The vulnerabilities, tracked as CVE-2025-20362 and CVE-2025-20333, impact the VPN web server component of these devices and can lead to remote code execution or unauthorized access. According to Cisco's advisory, CVE-2025-20362 allows unauthenticated, remote attackers to access restricted URL endpoints without authentication by sending specially crafted HTTP requests. CVE-2025-20333, on the other hand, enables authenticated attackers with valid VPN credentials to execute arbitrary code as root, potentially resulting in full device compromise. CISA has responded by adding both vulnerabilities to its Known Exploited Vulnerabilities Catalog and issuing an emergency directive (ED 25-03) that requires federal agencies to identify, analyze, and mitigate any potential compromises immediately. The vulnerabilities stem from improper validation of user-supplied input in HTTP(S) requests, making it possible for attackers to bypass security controls. Cisco has provided a list of vulnerable configurations, including those using AnyConnect IKEv2 Remote Access with client services enabled. The CVE-2025-20333 vulnerability is rated as critical with a CVSS score of 9.9, underscoring the severity of the threat. Exploitation of these flaws could allow attackers to gain root-level access, execute arbitrary code, and take full control of affected devices. The vulnerabilities affect a wide range of Cisco products, including ASA, FTD, and potentially IOS, IOS XE, and IOS XR software, as described in related advisories. Cisco has urged all customers to apply patches immediately to prevent exploitation. The vulnerabilities are being actively targeted, increasing the urgency for organizations to remediate affected systems. Attackers exploiting these flaws could use compromised devices as entry points into broader enterprise networks. The technical details highlight the importance of proper input validation in web services exposed to the internet. Organizations are advised to review their firewall configurations and ensure that all relevant updates are applied. The rapid response from CISA and Cisco reflects the high risk posed by these vulnerabilities to both public and private sector networks. Security teams should monitor for signs of compromise and follow Cisco's mitigation guidance to reduce exposure. The incident demonstrates the ongoing threat posed by zero-day vulnerabilities in widely deployed network security appliances.
Jun 29, 2026
Cisco disclosed multiple vulnerabilities affecting **Secure Firewall Management Center (FMC)**, **Secure Firewall Threat Defense (FTD)**, and **Adaptive Security Appliance (ASA)** software, including a **remote code execution** flaw tied to RADIUS handling in FMC and a separate **authentication bypass** issue in on-premises FMC. Additional advisories describe a **path traversal** vulnerability in FMC and FTD, expanding the risk to core firewall management and security enforcement platforms used in enterprise environments. The broader set of advisories also includes a **Snort deep inspection bypass** in FTD, a **TLS/Snort 3 denial-of-service** issue, a **SAML reflected cross-site scripting** flaw affecting ASA and FTD, a **VPN web services client-side request smuggling** vulnerability, and a **Lua code injection** bug in ASA and FTD. Taken together, the disclosures show that Cisco firewall products were exposed to weaknesses spanning **code execution, access control, traffic inspection evasion, denial of service, and web interface exploitation**, creating multiple paths for attackers to disrupt defenses or gain elevated access if affected systems remain unpatched.
Jul 12, 2026