Loading story…
Cisco disclosed and patched multiple high-severity vulnerabilities across enterprise products, led by Cisco Unity Connection flaws that could enable remote code execution and server-side request forgery. CVE-2026-20034 affects the web-based management interface and stems from insufficient validation of user-supplied input, allowing an authenticated remote attacker to send a crafted API request and execute arbitrary code as root, potentially fully compromising the device. Cisco also fixed CVE-2026-20035, an unauthenticated SSRF issue in the Web Inbox UI, and said successful exploitation of the Unity Connection bugs could result in code execution, SSRF, or denial-of-service conditions.
Cisco also addressed CVE-2026-20188, an uncontrolled resource consumption flaw in Cisco Crosswork Network Controller and Cisco Network Services Orchestrator caused by insufficient rate limiting on incoming network connections. An unauthenticated remote attacker could exhaust connection resources and make affected systems unresponsive until they are manually rebooted. Cisco said Crosswork Network Controller 7.1 and earlier are affected while 7.2 is not; NSO 6.3 and earlier and the 6.4 branch are affected, with fixes starting in 6.4.1.3 and 6.5 or later unaffected. Cisco reported no public proof-of-concept or active exploitation for the disclosed issues and urged customers to upgrade because no workaround is available for the DoS flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cisco disclosed CVE-2026-20188, an uncontrolled resource consumption vulnerability caused by insufficient rate limiting on incoming network connections in Cisco Crosswork Network Controller and Cisco Network Services Orchestrator. Cisco said unauthenticated attackers could exhaust connection resources and make systems unresponsive until manually rebooted, with fixes available in NSO 6.4.1.3 and later unaffected releases.
Cisco released patches and fixed software for high-severity Cisco Unity Connection vulnerabilities including CVE-2026-20034 and CVE-2026-20035. Cisco said exploitation could enable root-level code execution, SSRF, or denial-of-service impacts, and stated it had no evidence of public exploitation at disclosure time.
Cisco disclosed CVE-2026-20034, a high-severity flaw in the Cisco Unity Connection web-based management interface caused by insufficient validation of user input. An authenticated remote attacker could exploit it with a crafted API request to execute arbitrary code as root.
Cisco issued security advisories covering multiple product vulnerabilities, including the Crosswork Network Controller and Network Services Orchestrator denial-of-service flaw later tracked as CVE-2026-20188 and Unity Connection vulnerabilities later tracked as CVE-2026-20034 and CVE-2026-20035. The advisories established affected versions and remediation guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
sec.cloudapps.cisco.com
Open sourcecsirt.sk
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecvefeed.io
Open sourcesec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for multiple products after disclosing at least 15 vulnerabilities, including **eight critical** issues and several high-severity flaws. The most serious bugs affect **Cisco Secure Workload** and **Cisco Crosswork Data Gateway**, where vulnerabilities rated up to `CVSS 10.0` could allow **authentication bypass, remote code execution, path traversal, file overwrite or deletion, data manipulation, and filesystem compromise**. Cisco issued fixes including **Secure Workload 4.0.4.16 and 3.10.9.1** and patches for **Crosswork 7.2.1-SP**, while urging customers to follow product-specific security bulletins and upgrade affected systems promptly. Cisco also patched a high-severity **XML External Entity** flaw in **Cisco BroadWorks**, tracked as `CVE-2026-20320`, which could let unauthenticated attackers read sensitive configuration data and files through the OCI-P provisioning service; affected BroadWorks releases earlier than `RI.2026.07` should be upgraded because no workaround is available. Additional fixes were issued for products including **Network Controller**, **Planning**, **Packaged Contact Center Enterprise**, **RoomOS**, **Industrial Ethernet 1000 Series Switches**, **Unified Intelligence Center**, and **Cisco Talos Intelligence for Enterprise Security Cloud**. Cisco said it had **no evidence of active exploitation** at the time of disclosure.
Aug 20, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco released emergency fixes for two **critical (CVSS 10.0)** vulnerabilities in its firewall management software that could allow **remote, unauthenticated attackers** to execute code and gain **root-level** access to the underlying operating system. The issues are tracked as `CVE-2026-20079` and `CVE-2026-20131`, and reporting emphasized the risk profile given Cisco’s widespread deployment in large enterprises and the historical interest of sophisticated actors in rapidly weaponizing Cisco bugs. Available reporting stated there were **no confirmed in-the-wild exploitation** reports at the time of publication, but urged rapid patching due to the combination of unauthenticated reachability and full compromise potential. Separate coverage packaged the Cisco flaws alongside other weekly security items (e.g., Tycoon2FA infrastructure takedown and other incidents), but the Cisco item consistently described the same two maximum-severity firewall management vulnerabilities and their impact (RCE leading to root access).
Jun 29, 2026