❌

Visualização de leitura

↗️

Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

✇Cyber Security News
Por:Abinaya

Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root.

Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026.

The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled. Successful exploitation could give attackers control over the underlying operating system.

According to Cisco’s security advisory, the weakness sits in the database service and involves persistent cookies. Cisco also found that client certificates are not properly checked when clustering enables TLS Verify Mode. This means the enabled setting does not provide the expected certificate validation.

An attacker who has the required cookies and network access to an affected device could connect to its database service and invoke specific remote procedure call commands. These calls could allow the attacker to run commands with root privileges, the highest level of access on the system.

Cisco Expressway Vulnerability

Although Cisco describes the attacker as unauthenticated, possession of the cookies remains an important requirement. The advisory does not explain how an attacker would obtain them.

Readers should therefore avoid interpreting the finding as proof that an attacker can immediately compromise every reachable Expressway device.

The potential impact resembles other cases covered in Cyber Security News’ reporting on critical Cisco remote code execution flaws, though the affected products and attack methods differ.

Cisco lists Expressway X15.5.3 and earlier as affected, with X15.5.20 identified as the first fixed release. Customers using X14 or earlier must migrate to a fixed release. No workarounds address this vulnerability.

The fix is also included in Cisco’s broader October 2026 Expressway security hardening release. That release addresses additional weaknesses discovered during an internal security review.

Unlike this cluster-specific flaw, the broader hardening advisory covers affected Expressway-C and Expressway-E devices regardless of configuration. Administrators should check installed versions and cluster settings, then plan upgrades using Cisco’s compatibility guidance.

Checking the version alone does not establish exposure because this particular vulnerability also requires a clustered deployment. Broader coverage is available through Cyber Security News’ Cisco security updates.

Cisco credited Stefan Aleksic of Jane Street with reporting the vulnerability. At publication, its Product Security Incident Response Team said it was unaware of public announcements or malicious use. That statement does not reduce the need to patch affected clusters, given the potential for remote commands to run as root.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.

↗️

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

✇Security Affairs
Por:Pierluigi Paganini

Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise.

Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system.

“A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” reads the advisory. “This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”

The networking giant found this one in its own internal security scanning, which is at least some comfort, and became aware of active attacks in October.

The advisory highlights that cleanest that not every Cisco email gateway is vulnerable. The File Reputation service, part of the Advanced Malware Protection feature, has to be enabled and assigned to a mail policy, and the Content Scanner Tools version has to be earlier than 25.3.0.5525. If either condition doesn’t apply, the attack path doesn’t exist.

Checking is fast. To verify File Reputation status, open the web management interface and navigate to Mail Policies, then Advanced Malware Protection for either incoming or outgoing policies. To confirm the scanner version, run contentscannerstatus at the CLI. If the output shows anything older than 25.3.0.5525, the device is exposed.

The cleanest remediation is updating the Content Scanner Tools package.

“Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied.” continues the advisory. “Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.”

Gateways with automatic updates enabled should check that the update has been installed by verifying the scanner version. If automatic updates are disabled, administrators can run contentscannerupdate from the command line to install it manually.

Cisco has also released fixes in AsyncOS versions 15.5.5-014 and 16.5.0-780. Version 16.0 has no fixed release, so users must migrate to another version. Cisco recommends upgrading any version older than 16.5 directly to 16.5.0-780. Cisco-managed Secure Email Cloud customers are already protected and don’t need to take any action.

Cisco’s compromise check is a single command: grep "System Security" system_logs. It returns one of three outputs: a confirmed compromise indicator, a scan that failed to complete, or a clean result. The last one isn’t a guarantee, though.

“Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.” states the advisory. “Cisco strongly recommends that cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”

That means a clean log result isn’t proof the device wasn’t compromised. Cisco strongly recommends also pulling firewall and network logs from outside the appliance to look for unexpected uploads to external addresses or downloads from suspicious ones.

For virtual appliances, Cisco recommends rebuilding the system if it has been compromised. First, save forensic data, as upgrading the affected system will destroy it. Then deploy a new virtual machine with a fixed software version, rebuild the configuration from scratch without importing old configuration files, and change all credentials and cryptographic keys. Clustered systems need extra care because SSH keys are used to authenticate between members. If one system is compromised, its private keys could put the others at risk.

This is the third Cisco email gateway flaw that attackers have exploited to gain root access since December 2025. Previous incidents involved a SQL injection flaw reported in September and a zero-day in the spam quarantine feature. Cisco has now confirmed that attackers are exploiting two vulnerabilities disclosed in a September security update.

Read the full Cisco advisory for indicators of compromise and details of the fixed releases.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISCO)

↗️

Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges

✇Cyber Security News
Por:Abinaya

Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code with root privileges without logging in.

The flaws affect the Next Generation Operation, Administration, and Maintenance feature, known as NGOAM, in Cisco NX-OS Software. Successful attacks could also crash processes, force switches to reload, and disrupt network services.

Published on October 7, 2026, Cisco’s security advisory covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The advisory carries a CVSS base score of 9.8.

Cisco found the vulnerabilities during internal security testing and said its Product Security Incident Response Team was not aware of public announcements or malicious use when the advisory was released.

The flaws stem from improper validation of incoming IP traffic when NGOAM is enabled. An attacker can send crafted packets to an IP interface on an affected switch.

If exploitation succeeds, those packets could trigger code execution with root privileges, giving the attacker control at the operating system’s highest privilege level. The same attack path could cause a denial-of-service condition through process crashes and device reloads.

NGOAM supports network checks and troubleshooting. Its VXLAN functions help detect and address loops. In contrast, its Segment Routing over IPv6, or SRv6, functions help operators check connectivity and locate forwarding problems.

However, the exposure differs across the three vulnerabilities, so administrators must check both software versions and enabled features rather than treating every Nexus switch as affected.

Cisco Nexus Flaws

Cisco’s security advisory applies to Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode. CVE-2026-76485 requires only NGOAM to be enabled.

CVE-2026-76486 requires NGOAM alongside either SRv6 or a qualifying Network Virtualization Overlay configuration. For the overlay path, a VXLAN EVPN network identifier must be mapped to an NVE interface with at least one learned peer tunnel endpoint.

CVE-2026-76501 requires both NGOAM and SRv6. Nexus 3000 switches do not support SRv6, and only some Nexus 9000 models support it. Cisco confirmed that Nexus 9000 switches running in ACI mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not affected.

Administrators can check NGOAM with the show feature | include ngoam, overlay status with the show feature | include nve, and SRv6 with the show feature | include srv6. Overlay checks also require reviewing show running-config | begin "interface nve", show nve vni, and show nve peers to establish whether the required configuration exists.

Cisco says no workarounds address the vulnerabilities, but turning off an unneeded NGOAM feature removes the attack vector. Administrators can use the no feature ngoam command in global configuration mode after assessing the effect on network operations. Cisco has also released Live Protect shields as temporary protection, not a replacement for patched software.

Organizations should use the Cisco Software Checker to identify the fixed release for their platform. CybersecurityNews previously covered a separate Nexus 9000 root-code-execution flaw, CVE-2026-20212, affecting Silicon One models.

That issue had different exposure conditions; administrators should assess this NGOAM advisory independently and schedule the appropriate NX-OS upgrade.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges appeared first on Cyber Security News.

↗️

Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks

✇Cyber Security News
Por:Abinaya

Cisco has issued an urgent security advisory for a critical zero-day vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw, tracked as CVE-2026-76460, is already being actively exploited, according to Cisco’s Product Security Incident Response Team.

The vulnerability carries a maximum CVSS score of 10.0. It could allow an unauthenticated remote attacker to bypass authentication on affected systems.

Cisco confirmed that no workaround is available, making immediate software updates the primary remediation step. The issue stems from insufficient authentication controls on an API endpoint in Cisco ISE.

An attacker can send a specially crafted request to the vulnerable endpoint and gain unauthorized access by bypassing the web-based management interface.

Cisco ISE is widely used by organizations to control network access, enforce security policies, authenticate users and devices, and provide visibility into connected assets.

Cisco ISE 0-Day Vulnerability Exploited

A successful compromise could therefore give attackers a high-value entry point into enterprise identity and network-management environments. Cisco warned that successful exploitation may allow threat actors to obtain command execution with root privileges.

Root-level access would provide full control over an affected ISE node, allowing attackers to alter configurations, deploy malicious tools, create persistence, steal credentials, or use the appliance as a staging point for lateral movement.

The vulnerability affects Cisco ISE and Cisco ISE-PIC regardless of device configuration. Cisco ISE Software Release 3.0 is also exposed, but it has reached the end of software maintenance. Organizations using version 3.0 should migrate to a supported release that includes the security fix.

Cisco released patches for supported versions of the platform. The fixed releases are ISE 3.1 Patch 12, ISE 3.2 Patch 11, ISE 3.3 Patch 12, ISE 3.4 Patch 7, and ISE 3.5 Patch 4.

Administrators should identify their deployed version and upgrade to the appropriate fixed release as soon as possible. For organizations unable to patch immediately, Cisco recommends using infrastructure access control lists, or iACLs, to limit management and control-plane traffic reaching vulnerable devices.

Only essential and trusted systems should be allowed to communicate with Cisco ISE management interfaces. However, Cisco stressed that this mitigation is only temporary and does not remove the underlying vulnerability.

Administrators should also investigate systems for signs of exploitation. Cisco advised reviewing the access.log file for suspicious usernames or unexpected API activity.

In distributed ISE environments, check every node because an attacker may target any accessible node. Cisco provided an example command for reviewing suspicious login-related events: show logging application ise-kong/access.log | include dummyuser.

Security teams should collect support bundles with debug logs enabled to access additional API gateway logs. Cisco noted that evidence on a compromised device may be incomplete because attackers with root-level access could remove or hide forensic artifacts.

Organizations should also examine firewall and network logs outside the affected appliance. Unexpected uploads from an ISE node to external IP addresses, suspicious downloads, and unexplained outbound connections may indicate compromise.

If malicious activity is identified or strongly suspected, Cisco recommends reimaging affected ISE nodes and restoring configurations from a known-good backup. The vendor discovered the vulnerability while resolving a Cisco Technical Assistance Center support case.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks appeared first on Cyber Security News.

↗️

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

✇Security Affairs
Por:Pierluigi Paganini

Cisco warns of a critical zero-day in Secure Email Gateway, exploited in the wild to gain root access through malicious emails.

Cisco disclosed a critical zero-day, tracked as CVE-2026-76461 (CVSS score of 9.8), affecting Secure Email Gateway appliances. The flaw can be exploited remotely without authentication. Attackers can send specially crafted emails containing malicious SQL statements, triggering arbitrary command execution on the underlying system with root privileges. Cisco confirmed the vulnerability is already being exploited in the wild.

“A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.” reads the report published by the networking giant.

“This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.”

According to the advisory, the vulnerability affects Cisco Secure Email Gateway, both physical and virtual, regardless of device configuration. The company states that there are no workarounds that address this issue.

Recently, the company’s PSIRT became aware of active exploitation of this vulnerability.

Check Secure Email Gateway logs for suspicious SQL statements to detect possible exploitation. If the device is part of a cluster, check every device. Cisco says customers using Secure Email Cloud may not be able to check these indicators themselves, but those with detected malicious activity were contacted directly.

“To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device.” states the advisory. “The following is a non-exhaustive example of how a malicious SQL statement could be detected in the logs:

cisco-esa> grep -i "COPY.*TO PROGRAM" [IronPort Text Mail Logs Log name - Default: mail_logs]

The presence of any entry in the output may indicate malicious activity.”

On September 14, US CISA added CVE-2026-76461 to its Known Exploited Vulnerability to Catalog (KEV) and ordered federal organizations to address it by September 17.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Secure Email Gateway)

↗️

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

✇Security Affairs
Por:Pierluigi Paganini

Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.

Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run scripts and potentially gain root access. Attackers also exploit CVE-2026-20316 to access sensitive data through a low-privilege account. The second flaw can be chained with other FMC vulnerabilities to increase privileges.

Cisco linked the attacks to ransomware operations, including Qilin, as well as state-sponsored activity.

“Talos’ analysis illustrates three clusters of post-compromise activity on FMC instances associated with state-sponsored and crimeware threat actors, as described below.” reads the advisory. “The first cluster which we track as UAT-12197, involves the exploitation of CVE-2026-20079, leading to the deployment of web shells, a Java Archive (JAR)-based command executor, and credential exfiltration.”

Talos identified three attack clusters targeting Cisco Secure Firewall Management Center (FMC). The first cluster deploys JSP-based web shells and custom command executors into Tomcat webroot directories to query internal databases and harvest user authentication data and credentials.

“This cluster of activity involved the successful exploitation of CVE-2026-20079 and the subsequent placement of a malicious web shell in the CSM Tomcat webroot directory.” reads the report. “The web shell is JSP-based and Base64 decodes a parameter labelled “F6C1F0E7”, consisting of the class name to load in the JAVA process:”

The second cluster, attributed to the advanced persistent threat actor UAT-11823 with tooling overlapping Sandworm, establishes Netcat reverse shells, harvests device configurations, and installs the modular ELF malware “Cyclops Blink” for persistent access, DNS over HTTPS resolution, and packet sniffing.

“The threat actor obtained initial access to compromised systems by either exploiting CVE-2026-20079 or via static credentials.” Talos states. “After obtaining access, UAT-11823 subsequently updated the “license.tmp” file on disk (using Makeself) with a malicious copy to establish a Netcat-based reverse shell to their own command-and-control (C2) server:”

The third cluster involves Qilin ransomware operators (UAT-11988) who use static credentials for initial access, perform extensive domain reconnaissance, deploy SOCKS proxies and reverse-SSH tunnels, and execute AV killers before deploying ransomware.

“Once extensive reconnaissance was completed, the threat actor attempted to establish persistent network access into the victim organization using a Python SOCKS5 proxy (socks5.py) and a reverse-SSH tunnel from the FMC back to the attacker’s own remote host. The following ports were forwarded: LDPA (389), LDAPS (636), Kerberos (88), SMB (445), NETBIOS (135), and WinRM (5985).” concludes the report. “The threat actor conducted extensive probing of endpoints in the victim’s environment, deployed open-source tooling such as impacket, Invoke-TheHash, and custom-made AV killers — all followed by the deployment of the Qilin ransomware on selected endpoints.”

Cisco strongly urges customers to immediately apply released hotfixes and update detection rules using the provided Snort SIDs while awaiting upcoming comprehensive security hardening updates.

CISA added CVE-2026-20079 to its KEV catalog, requiring U.S. federal agencies to patch it by September 12, 2026. CVE-2026-20316 was added in late July.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco FMC)

↗️

Talos: Attackers Refine Phishing Playbook To Target Critical Infrastructure

✇The Security Ledger
Por:Paul Roberts

Phishing played a part in more than half of all incident response engagements undertaken by Talos, Cisco's threat research organization, during the second quarter of 2026, with healthcare organizations and manufacturing firms among the top targets.

The post Talos: Attackers Refine Phishing Playbook To Target Critical Infrastructure appeared first on The Security Ledger with Paul F. Roberts.

❌