Cisco’s internal security review of Catalyst SD-WAN Manager and Controller software uncovered five separate flaws, one rated 9.9, that a low-privileged network attacker could exploit without any user interaction.
Posts tagged: Cisco
Cisco IOS XE Software Security Hardening Release: August 2026
Cisco’s own engineers found seven flaws in IOS XE running in autonomous or controller mode, including a critical injection bug reachable over the network with no login needed, and there is no workaround short of upgrading.
Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
An unauthenticated attacker who can reach the FMC web interface can exploit a flawed boot-time process to run scripts and gain root on the underlying operating system, no credentials needed.
Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability
An authenticated user with only Observer-level access to Cisco Catalyst Center’s virtual appliance can send a crafted HTTP request to gain full Administrator control.
Cisco Catalyst Center REST API Command Injection Vulnerability
An Observer-level account with API access to Cisco Catalyst Center can inject commands that run as root inside a restricted container, no admin privileges needed.
Cisco Catalyst Center Cross-Site Scripting Vulnerability
A stored input-validation flaw in Cisco Catalyst Center’s web management interface lets an attacker run script in an operator’s browser via a crafted link, exposing session data or tokens.
Cisco Catalyst Center Privilege Escalation Vulnerability
A broken access control check in Cisco Catalyst Center lets a logged-in read-only user change policy configurations that should be locked to Administrator accounts.
Cisco Catalyst Center Virtual Appliance HTTP Open Redirect Vulnerability
Cisco Catalyst Center Virtual Appliance on VMware ESXi can be tricked into redirecting management-interface users to attacker-controlled pages via a tampered HTTP request, with no fix short of upgrading.
Cisco Unified Contact Center Express Remote Code Execution Vulnerabilities
Two unrelated bugs in Cisco Unified CCX’s Java RMI process and CCX Editor let an unauthenticated attacker upload files, bypass authentication, and run commands as root or as an internal user, with no workaround available.
Cisco Identity Services Engine Reflected Cross-Site Scripting and Information Disclosure Vulnerabilities
Authenticated users of Cisco ISE’s web management interface could trigger reflected XSS or pull sensitive data due to weak input validation, with fixes only via patched releases and no interim workaround.