#cisco

CVE-2026-76460: Management Interface Bypass in Cisco Identity Services Engine

Cisco Identity Services Engine and ISE Passive Identity Connector let an unauthenticated attacker gain access to the device by bypassing the web-based management interface...

CVE-2026-76461: SQL Injection in Cisco Secure Email Gateway

Cisco AsyncOS for Secure Email Gateway contains a SQL injection vulnerability that lets an unauthenticated remote attacker execute arbitrary commands with root privileges...

CVE-2026-20079: Authentication Bypass in Cisco Secure Firewall Management Center

Cisco Secure Firewall Management Center and Security Cloud Control Firewall Management allow an unauthenticated remote attacker to bypass authentication and execute script files as root...

CVE-2026-20212: unauthenticated root code execution in Cisco Nexus 9000 switches

TCP ports 43210 and 43211 of the Silicon One integration are reachable in the default Layer 3 VRF, letting an unauthenticated attacker execute code with root privileges on the switch...

CVE-2026-20274 and CVE-2026-20279: Cisco IOS XR hardening release — no workarounds

Cisco published IOS XR hardening releases closing seven vulnerability classes found in its own code review — all releases are affected, regardless of device configuration...

CVE-2026-20357: Three critical flaws in Cisco Crosswork — hardening release

An internal Cisco security review uncovered multiple vulnerabilities in Crosswork. The hardening release closes, among others, missing authentication for a critical function...

CVE-2026-20181: Authenticated Command Execution in Cisco ISE

A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerabi...

CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbi...

CVE-2026-20230: SSRF and Arbitrary File Write in Cisco Unified CM (CUCM)

A public PoC was released for CVE-2026-20230 in Cisco Unified Communications Manager. Insufficient input validation in the WebDialer component enables remote SSRF and arbitrary file write....

CVE-2026-20223: Critical Authentication Bypass in Cisco Secure Workload

Critical access-validation vulnerability in Cisco Secure Workload internal REST APIs (3.9.x and earlier, 3.10.x < 3.10.8.3, 4.0.x < 4.0.3.17) - unauthenticated remote attacker can obtain Site Admin privileges...

CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges ...

Fortinet FortiGate vs Cisco Firepower — NGFW comparison (2026)

CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file...

CVE-2026-20147: Authenticated command execution in Cisco ISE

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vul...

CVE-2026-20180: Authenticated command execution in Cisco Identity Services Engine

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit...

CVE-2026-20184: SSO impersonation in Cisco Webex Services Control Hub

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. ...

CVE-2026-20186: Authenticated command execution in Cisco Identity Services Engine

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit...

CVE-2026-20093: Authentication bypass in Cisco Integrated Management Controller

A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the sys...

CVE-2026-20160: Unauthenticated command execution in Cisco Smart Software Manager On-Prem

A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SS...

CVE-2026-20131: unauthenticated RCE as root in Cisco Secure Firewall Management Center (CVSS 10.0)

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management ...

CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, rem...

CVE-2022-20775: 2022 Vulnerability Now Actively Exploited (Cisco)

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CL...