Loading story…
Cisco disclosed a critical certificate validation vulnerability in cloud-based Webex Services that could let an unauthenticated remote attacker bypass authentication and impersonate legitimate users in environments using single sign-on through Webex Control Hub. The flaw, tracked as CVE-2026-20184 and rated CVSS 9.8, stems from improper certificate validation in the SSO implementation (CWE-295), which could cause malicious authentication tokens to be accepted as valid.
Cisco said it patched the backend cloud service, but affected organizations must also manually upload a new SAML certificate for their Identity Provider in Webex Control Hub to fully remediate the issue. The company said there are no workarounds, warned that customers who do not update their SAML certificates may remain exposed and could face service disruption, and added that the vulnerability was found during internal security testing with no known public exploitation reported at disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco released patches for three critical Identity Services Engine vulnerabilities, tracked as CVE-2026-20180, CVE-2026-20186, and CVE-2026-20147. The flaws could allow authenticated attackers with administrative privileges to execute remote code on the underlying operating system of affected ISE devices.
Cisco said customers using affected SSO integrations must manually upload a new SAML certificate for their Identity Provider in Webex Control Hub to fully remediate the issue. It warned there are no workarounds and that organizations that do not update certificates may remain vulnerable or face service disruption.
Cisco disclosed CVE-2026-20184 in a security advisory and said it had patched the affected cloud backend service. The company stated there was no evidence of public exploitation at the time of disclosure.
Cisco discovered a certificate validation vulnerability in Webex Services during internal security testing. The flaw, later tracked as CVE-2026-20184, affects SSO integrations in Webex Control Hub and could allow unauthenticated attackers to impersonate legitimate users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20223**, a critical `CVSS 10.0` vulnerability in Cisco Secure Workload Cluster Software that allows an unauthenticated remote attacker to gain **Site Admin** privileges by sending crafted requests to internal REST API endpoints. The flaw stems from insufficient authentication and access validation (`CWE-306`) and affects both **SaaS** and **on-premises** deployments, enabling access to site resources, exposure of sensitive information, and configuration changes that can cross tenant boundaries. Cisco said its hosted SaaS environments have already been remediated, while customers running affected versions must upgrade because **no workaround is available**. Fixed releases include **3.10.8.3** and **4.0.3.17**, with the issue affecting version **3.9 and earlier**, versions before **3.10.8.3**, and versions before **4.0.3.17**. Cisco and the Canadian Centre for Cyber Security urged administrators to review the advisory and apply updates promptly; Cisco said it is not aware of active exploitation and reported that the vulnerability was identified during internal security testing.
Jun 29, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Jun 29, 2026