Cisco SD-WAN RCE via CVE-2026-20182 — Mitigation Guide
Cisco patches CVE-2026-20182, the sixth SD-WAN zero-day exploited in 2026. Learn how threat actor UAT-8616 leverages this flaw for targeted attacks.
Cisco Catalyst SD-WAN Authentication Bypass: CVE-2026-20182 Exploit
CISA adds CVE-2026-20182 to its KEV catalog after reports of active exploitation against Cisco Catalyst SD-WAN Controllers. Critical patch required.
Cisco Catalyst SD-WAN Controller Authentication Bypass via CVE-2026-20182 Exploited in Zero-Day Attacks
Cisco warns of a critical authentication bypass in Catalyst SD-WAN Controller (CVE-2026-20182) actively exploited in zero-day attacks, granting admin access.
CVE-2026-20182: Cisco SD-WAN Auth Bypass Actively Exploited
Cisco Catalyst SD-WAN Controller and Manager face critical authentication bypass CVE-2026-20182, actively exploited for admin access. Patch now.
Cisco ISE and Nexus Dashboard RCE via CVE-2024-20469 — Mitigation Guide
Cisco patches high-severity vulnerabilities in ISE, Nexus Dashboard, and Catalyst Center that enable RCE, SSRF, and DoS attacks. Secure your enterprise today.
Cisco Crosswork & NSO DoS: Manual Reboot Needed Post-Exploit
Cisco Crosswork Network Controller and Network Services Orchestrator are vulnerable to a denial-of-service flaw, necessitating manual reboots for recovery.
Cisco Acquires Astrix: Tackling Non-Human Identity Risks for AI & Machines
Cisco's acquisition of Astrix Security targets emerging non-human identity risks in AI and machine access, enhancing identity-centric security for cloud environments.
Firestarter Malware Persists on Cisco Firewalls Post-Update
U.S. and U.K. agencies warn about Firestarter malware exhibiting post-update persistence on Cisco Firepower and Secure Firewalls running ASA/FTD.
FIRESTARTER Backdoor Exploits Cisco Firepower ASA Software
CISA and NCSC reveal FIRESTARTER, a persistent backdoor targeting Cisco Firepower devices running ASA software, used in federal agency compromises.
Firestarter Backdoor Infects Cisco Firewall at US Federal Agency
Analysis of the Firestarter backdoor on Cisco firewalls, detailing its remote access capabilities, post-patch persistence, and mitigation strategies.
FIRESTARTER Backdoor: Persistent Threat to Cisco Firepower & Secure Firewall
CISA and NCSC warn of FIRESTARTER, an APT-deployed backdoor maintaining persistence on Cisco Firepower and Secure Firewall devices post-patching.
Anthropic AI Agent Memory Vulnerability: Data Exposure Risks
Cisco discovered a significant memory handling vulnerability in Anthropic AI agents, risking data exposure. This highlights persistent security challenges in AI systems.
CISA KEV Expansion: Exploit Guidance for Cisco, Kentico, and Zimbra
CISA adds 8 vulnerabilities to the KEV catalog, including critical flaws in Cisco ASA and Zimbra. Analyze technical impact and remediation requirements.
CISA KEV Update: Eight New Vulnerabilities in Cisco, TeamCity, and Zimbra
CISA adds eight vulnerabilities to the KEV Catalog, including flaws in Cisco SD-WAN and JetBrains TeamCity, requiring immediate federal agency remediation.
CISA Adds 8 Flaws to KEV: Cisco and PaperCut Exploited in the Wild
CISA adds 8 vulnerabilities to its KEV catalog, including PaperCut and Cisco SD-WAN Manager flaws, with federal patching deadlines set for May 2026.
Cisco Webex Services CVE-2024-20419: Manual Patch Guidance
Cisco identifies a critical improper certificate validation flaw in Webex Services. This advisory details the required manual remediation steps for admins.
Cisco Patches Critical RCE and SSO Flaws in ISE and Webex Services
Cisco releases patches for four critical vulnerabilities, including CVE-2026-20184, which allows RCE and user impersonation in Identity Services and Webex.
Cisco FMC Zero-Day Exploited by Interlock Ransomware: March 2026 CVEs
Runtime Rebel analyzes March 2026's significant rise in high-impact CVEs, including a Cisco FMC zero-day actively exploited by Interlock Ransomware.
TeamPCP Supply Chain Campaign: Cisco Source Code Stolen, UNC6780 Activity
Analysis of the TeamPCP supply chain campaign, including the theft of Cisco source code and over 1,000 compromised SaaS environments tracked by Google GTIG as UNC6780.
Claude Mythos Identifies Thousands of Zero-Day Flaws in Major Systems
Anthropic's Project Glasswing uses the Claude Mythos AI model to uncover thousands of zero-day vulnerabilities across infrastructure from AWS, Google, and Cisco.
Cisco IMC and SSM RCE via CVE-2026-20093 — Mitigation Guide
Cisco patches a critical 9.8 CVSS vulnerability in Integrated Management Controller (IMC) allowing unauthenticated remote attackers to gain full system access.
CVE-2024-20359: Cisco IMC Auth Bypass Grants Admin Access
Cisco IMC critical authentication bypass (CVE-2024-20359) allows unauthenticated attackers admin access. Learn about the vulnerability and urgent patch guidance.
Cisco Source Code Stolen: Trivy Supply Chain Attack Leads to Breach
Threat actors breached Cisco's dev environment using credentials from a Trivy supply chain attack, stealing proprietary and customer source code.
CVE-2026-20131: Cisco FMC/SCC Deserialization Vulnerability Under Active Attack
CISA adds CVE-2026-20131, a critical deserialization vulnerability in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC), to KEV Catalog due…