Topic
Latest Cisco coverage — 7 articles.
CISA added a Cisco firewall VPN flaw and a CVSS 10.0 GitLab RCE to KEV on the same day, both due November 1. Here are the affected versions, the fixes, and why checking the version alone can leave you exposed.
CISA added four CVEs to KEV on October 14: Cisco Secure Email Gateway, AhsayCBS, and Palo Alto PAN-OS. All were exploited before a full fix existed, and the due date for every one is October 17.
Six exploited CVEs reached CISA's KEV catalog between September 29 and October 4, covering Apple, Cisco, Fortinet, Zammad, and NetScaler. Each calls for a different first move, from a simple upgrade to a workaround because no patch exists.
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
CISA added seven actively exploited vulnerabilities to its KEV catalog in one week, spanning Cisco, Acronis, Google Pixel, and the Linux kernel. Here is what happened, in order, and what is due today.
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication entirely, CVSS 10.0, already under active exploitation. It's the second Cisco zero-day found via live incident response this week.
CVE-2026-76461 lets an unauthenticated attacker reach root on Cisco Secure Email Gateway with nothing but a crafted email. Cisco found it while investigating an active intrusion, not before one.
