Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2018-4063, a high-severity remote code execution (RCE) vulnerability affecting Sierra Wireless AirLink ALEOS routers, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, which allows authenticated attackers to upload malicious files via a specially crafted HTTP request to the upload.cgi endpoint, can result in arbitrary code execution with root privileges due to insufficient file upload restrictions and the elevated permissions of the ACEManager process. Cisco Talos originally disclosed the vulnerability in 2019, highlighting the risk that attackers could overwrite executable files on the device to gain full control.
CISA's action follows evidence of active exploitation in the wild and mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the vulnerability to protect their networks. While the directive is binding for FCEB agencies, CISA strongly urges all organizations using affected Sierra Wireless routers to prioritize patching and mitigation efforts, as this type of vulnerability is a common vector for malicious cyber activity and poses significant risk to enterprise environments.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA directed Federal Civilian Executive Branch agencies to address CVE-2018-4063 by the specified deadline. Because many affected routers are end-of-support and may not be patchable, agencies were told to update them where possible or discontinue use by January 2, 2026.
CISA added CVE-2018-4063 to its Known Exploited Vulnerabilities catalog after finding evidence of active exploitation. The agency warned the flaw poses significant risk because affected Sierra Wireless AirLink ALEOS devices are often legacy or end-of-support systems.
Research cited in later reporting said the Chaya_005 threat cluster exploited CVE-2018-4063 in early 2024, showing the router flaw was being used in real-world attacks. Honeypot observations also indicated industrial routers were being targeted by botnet and cryptominer malware.
Cisco Talos publicly disclosed CVE-2018-4063, an unrestricted file upload vulnerability in Sierra Wireless AirLink ALEOS that can enable remote code execution. The flaw affects ALEOS versions prior to 4.9.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcewebpronews.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2008-4128** to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation of a cross-site request forgery flaw in **Cisco IOS 12.4** on **Cisco 871 Integrated Services Routers**. The vulnerability affects the HTTP Administration interface and can let a remote attacker trick an authenticated administrator into executing arbitrary commands through crafted HTTP requests and specific URIs tied to functions such as `show privilege` and `alias exec`. The KEV catalog update increased the total number of listed vulnerabilities from **1637** to **1638** and marked ransomware use as unknown for this Cisco issue. CISA directed organizations to apply vendor mitigations and said federal civilian executive branch agencies must remediate the flaw under applicable Binding Operational Directive requirements, with the catalog listing a remediation due date of **2026-07-16**; private-sector defenders were also urged to review the KEV entry and address affected devices in their environments.
Aug 15, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026
Multiple critical vulnerabilities have been discovered in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) WebVPN components, which are being actively exploited in the wild. The vulnerabilities, identified as CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, allow attackers to bypass authentication and achieve remote code execution (RCE) as root on affected devices. CVE-2025-20362 is an unauthenticated authorization bypass that enables attackers to access restricted endpoints without valid credentials, serving as a key component in exploit chains. When combined with CVE-2025-20333, attackers can send malicious HTTPS requests to execute arbitrary code as root, even without prior authentication. CVE-2025-20363 is a related flaw that also enables unauthenticated RCE on ASA/FTD devices and authenticated RCE on some Cisco IOS components. These vulnerabilities affect Cisco ASA versions 9.16 through 9.23 and Cisco FTD versions 7.0 through 7.7, with specific software images requiring validation against Cisco advisories. Cisco and CISA have confirmed active exploitation and widespread scanning for these vulnerabilities, prompting CISA to issue Emergency Directive 25-03 on September 25, 2025, mandating immediate action by federal agencies. The threat actor responsible for these attacks is attributed to the same group behind the ArcaneDoor (UAT4356) state-sponsored espionage campaign first observed in 2024. Organizations are urged to patch or upgrade to Cisco’s fixed releases without delay, and to restrict or disable vulnerable devices if immediate upgrades are not possible. Compromised devices should be isolated and thoroughly investigated for signs of threat actor presence. Cisco has provided detailed guidance for detection, and CISA’s Malware Next Generation tool can be used to hunt for indicators of compromise. Security researchers, including Rapid7, have published technical analyses and exploit chains demonstrating the severity and ease of exploitation. The vulnerabilities are considered highly critical due to their unauthenticated nature and the potential for full device compromise, which could lead to further lateral movement within affected networks. The rapid response from both Cisco and CISA underscores the urgency and scale of the threat. Organizations using Cisco ASA or FTD devices should assume exposure if running affected versions and prioritize remediation. The vulnerabilities highlight the ongoing targeting of network edge devices by sophisticated threat actors, particularly those engaged in espionage. Failure to address these vulnerabilities could result in significant operational disruption and data compromise. The security community continues to monitor for new exploitation techniques and advises ongoing vigilance. The release of proof-of-concept code and active scanning increases the risk of opportunistic attacks by additional threat actors. Timely patching and adherence to Cisco and CISA recommendations are essential to mitigate risk from these critical vulnerabilities.
Jun 29, 2026