pwn.watch: Cisco incident updates

[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Wed, 14 Oct 2026 00:00:00 GMT

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.

Status: live · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-10-14: CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17).

CVEs: CVE-2026-76519

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Wed, 30 Sep 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Added to CISA KEV on 2026-09-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-30: CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03).

CVEs: CVE-2026-76504

[high] Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Wed, 16 Sep 2026 00:00:00 GMT

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Added to CISA KEV on 2026-09-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-16: CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19).

CVEs: CVE-2026-76460

[high] Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability

Mon, 14 Sep 2026 00:00:00 GMT

Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Added to CISA KEV on 2026-09-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-14: CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17).

CVEs: CVE-2026-76461

[high] Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using

Wed, 09 Sep 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-09: CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12).

CVEs: CVE-2026-20079

[high] Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) : Cisco Secure Firewall Adaptive Security Appliance (ASA) and S

Tue, 11 Aug 2026 00:00:00 GMT

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. Added to CISA KEV on 2026-08-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-11: CISA added CVE-2026-20349 to the KEV catalog (due 2026-08-14).

CVEs: CVE-2026-20349

[high] Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Wed, 29 Jul 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. Added to CISA KEV on 2026-07-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-29: CISA added CVE-2026-20316 to the KEV catalog (due 2026-08-01).

CVEs: CVE-2026-20316

[high] Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Thu, 25 Jun 2026 00:00:00 GMT

Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. Added to CISA KEV on 2026-06-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-25: CISA added CVE-2026-20230 to the KEV catalog (due 2026-06-28).

CVEs: CVE-2026-20230

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Mon, 15 Jun 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. Added to CISA KEV on 2026-06-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-15: CISA added CVE-2026-20262 to the KEV catalog (due 2026-06-29).

CVEs: CVE-2026-20262

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Tue, 09 Jun 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. Added to CISA KEV on 2026-06-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-06-09: CISA added CVE-2026-20245 to the KEV catalog (due 2026-06-23).

CVEs: CVE-2026-20245

[high] Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Thu, 14 May 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. Added to CISA KEV on 2026-05-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-14: CISA added CVE-2026-20182 to the KEV catalog (due 2026-05-17).

CVEs: CVE-2026-20182

[high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Mon, 20 Apr 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems. CISA added CVE-2026-20133, CVE-2026-20128 to the Known Exploited Vulnerabilities catalog on 2026-04-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-20: CISA added CVE-2026-20133, CVE-2026-20128 to the KEV catalog (due 2026-04-23).

CVEs: CVE-2026-20133, CVE-2026-20128

[high] Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Mon, 20 Apr 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges. Added to CISA KEV on 2026-04-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-20: CISA added CVE-2026-20122 to the KEV catalog (due 2026-04-23).

CVEs: CVE-2026-20122

[high] Cisco Secure Firewall Management Center (FMC): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management

Thu, 19 Mar 2026 00:00:00 GMT

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-19: CISA added CVE-2026-20131 to the KEV catalog (due 2026-03-22).

CVEs: CVE-2026-20131

[critical] Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)

Sat, 28 Feb 2026 00:00:00 GMT

In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.

Status: closed · Patch: patched · Fixed in: Cisco fixed releases per advisory

[high] Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Wed, 25 Feb 2026 00:00:00 GMT

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration f

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-25: CISA added CVE-2026-20127 to the KEV catalog (due 2026-02-27).

CVEs: CVE-2026-20127

[high] Cisco Unified Communications Manager: Cisco Unified Communications Products Code Injection Vulnerability

Wed, 21 Jan 2026 00:00:00 GMT

Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Added to CISA KEV on 2026-01-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-01-21: CISA added CVE-2026-20045 to the KEV catalog (due 2026-02-11).

CVEs: CVE-2026-20045

[critical] Cisco Multiple Products: Multiple Products Improper Input Validation Vulnerability

Wed, 17 Dec 2025 00:00:00 GMT

Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. Added to CISA KEV on 2025-12-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-17: CISA added CVE-2025-20393 to the KEV catalog (due 2025-12-24).

CVEs: CVE-2025-20393

[high] Cisco IOS and IOS XE: IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Mon, 29 Sep 2025 00:00:00 GMT

Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system. Added to CISA KEV on 2025-09-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-29: CISA added CVE-2025-20352 to the KEV catalog (due 2025-10-20).

CVEs: CVE-2025-20352

[critical] Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense: 2 exploited vulnerabilities (CVE-2025-20333, CVE-2025-20362)

Thu, 25 Sep 2025 00:00:00 GMT

CVE-2025-20333: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362. CVE-2025-20362: Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333. Added to CISA KEV on 2025-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-25: CISA added CVE-2025-20333 to the KEV catalog (due 2025-09-26).
2025-09-25: CISA added CVE-2025-20362 to the KEV catalog (due 2025-09-26).

CVEs: CVE-2025-20333, CVE-2025-20362

[critical] Cisco Identity Services Engine: 2 exploited vulnerabilities (CVE-2025-20281, CVE-2025-20337)

Mon, 28 Jul 2025 00:00:00 GMT

CVE-2025-20281: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CVE-2025-20337: Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. Added to CISA KEV on 2025-07-28.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-07-28: CISA added CVE-2025-20281 to the KEV catalog (due 2025-08-18).
2025-07-28: CISA added CVE-2025-20337 to the KEV catalog (due 2025-08-18).

CVEs: CVE-2025-20281, CVE-2025-20337

[critical] Cisco Smart Licensing Utility: Smart Licensing Utility Static Credential Vulnerability

Mon, 31 Mar 2025 00:00:00 GMT

Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials. Added to CISA KEV on 2025-03-31.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-31: CISA added CVE-2024-20439 to the KEV catalog (due 2025-04-21).

CVEs: CVE-2024-20439

[medium] Cisco Small Business RV Series Routers: Small Business RV Series Routers Command Injection Vulnerability

Mon, 03 Mar 2025 00:00:00 GMT

Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data. Added to CISA KEV on 2025-03-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-03: CISA added CVE-2023-20118 to the KEV catalog (due 2025-03-24).

CVEs: CVE-2023-20118

[medium] Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS)

Tue, 12 Nov 2024 00:00:00 GMT

Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Added to the CISA KEV catalog on 2024-11-12. CVE-2014-2120 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-12: CISA added CVE-2014-2120 to the KEV catalog (federal deadline 2024-12-03) (source)

CVEs: CVE-2014-2120

[medium] Cisco ASA and FTD Denial-of-Service

Thu, 24 Oct 2024 00:00:00 GMT

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Added to the CISA KEV catalog on 2024-10-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-24: CISA added CVE-2024-20481 to the KEV catalog (federal deadline 2024-11-14) (source)
2024-10-23: CVE-2024-20481 published (source)

CVEs: CVE-2024-20481

[medium] Cisco NX-OS Command Injection

Tue, 02 Jul 2024 00:00:00 GMT

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Added to the CISA KEV catalog on 2024-07-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-02: CISA added CVE-2024-20399 to the KEV catalog (federal deadline 2024-07-23) (source)
2024-07-01: CVE-2024-20399 published (source)

CVEs: CVE-2024-20399

[high] Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign

Wed, 24 Apr 2024 00:00:00 GMT

Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-04-24: CVE-2024-20353 published (source)
2024-04-24: CVE-2024-20359 published (source)
2024-04-24: CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01) (source)

CVEs: CVE-2024-20353, CVE-2024-20359

[high] Cisco ASA and FTD Information Disclosure

Thu, 15 Feb 2024 00:00:00 GMT

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-02-15: CISA added CVE-2020-3259 to the KEV catalog (federal deadline 2024-03-07) (source)

CVEs: CVE-2020-3259

[critical] Cisco IOS XE web UI zero-days: implants on tens of thousands of devices

Mon, 23 Oct 2023 00:00:00 GMT

Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.

Status: closed · Patch: patched · Fixed in: 17.9.4a, 17.6.6a, 17.3.8a, 16.12.10a (Catalyst 3650/3850 only)

Latest updates:

2023-10-23: CISA adds CVE-2023-20273 to the KEV catalog
2023-10-22: First fixed release, 17.9.4a, published (source)
2023-10-20: Cisco discloses the second bug (CVE-2023-20273) used to write the implant as root

CVEs: CVE-2023-20198, CVE-2023-20273

[medium] Cisco IOS and IOS XE: Group Encrypted Transport VPN Out-of-Bounds Write (CVE-2023-20109)

Tue, 10 Oct 2023 00:00:00 GMT

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. Added to CISA KEV on 2023-10-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-10: CISA added CVE-2023-20109 to the KEV catalog (due 2023-10-31).

CVEs: CVE-2023-20109

[critical] Cisco Adaptive Security Appliance and Firepower Threat Defense: Unauthorized Access (CVE-2023-20269)

Wed, 13 Sep 2023 00:00:00 GMT

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. Added to CISA KEV on 2023-09-13. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-13: CISA added CVE-2023-20269 to the KEV catalog (due 2023-10-04).

CVEs: CVE-2023-20269