Loading story…
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting Smart Software Manager On-Prem, Integrated Management Controller, Nexus Dashboard Fabric Controller, and Secure Firewall Management Center. Additional high- and medium-severity issues impact IOS XE and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems.
One of the most severe issues, CVE-2026-20223, affects Cisco Secure Workload and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as CWE-306 and rated CVSS 10.0, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions 3.10.8.3 and 4.0.3.17; reporting cited no known active exploitation or public proof-of-concept at the time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco addressed CVE-2026-20223, a critical authentication bypass in Cisco Secure Workload, in versions 3.10.8.3 and 4.0.3.17. The flaw allowed unauthenticated access to internal REST API endpoints and administrative actions in both SaaS and on-premises deployments.
Cisco disclosed or updated a roundup of security advisories affecting products including IOS XE, Nexus Dashboard, Integrated Management Controller, Smart Software Manager On-Prem, and Secure Firewall. The issues included critical remote code execution, authentication bypass, arbitrary command execution, denial of service, privilege escalation, and other flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed multiple vulnerabilities in its Integrated Management Controller (**IMC**), including the critical `CVE-2026-20093`, which allows a remote, unauthenticated attacker to send a crafted HTTP request to bypass authentication and change passwords for existing users, including the primary Admin account. Cisco rated the flaw **CVSS 9.8** and said no workarounds or mitigations are available, making vendor-issued software updates the only effective fix; the company added that it has no evidence of active exploitation or public malicious use. Additional advisories cover `CVE-2026-20094` through `CVE-2026-20097`, spanning command injection and arbitrary code execution issues that could let attackers execute commands or code as `root` and fully compromise affected systems. Impacted products include Cisco UCS C-Series and S-Series servers, UCS E-Series systems, Catalyst 8300 Series Edge uCPE, 5000 Series ENCS, and other Cisco appliances built on vulnerable UCS platforms, with Cisco publishing fixed-version guidance and upgrade paths while runZero released an inventory query to help organizations identify exposed IMC assets.
Jun 29, 2026
Cisco disclosed **CVE-2026-20223**, a critical `CVSS 10.0` vulnerability in Cisco Secure Workload Cluster Software that allows an unauthenticated remote attacker to gain **Site Admin** privileges by sending crafted requests to internal REST API endpoints. The flaw stems from insufficient authentication and access validation (`CWE-306`) and affects both **SaaS** and **on-premises** deployments, enabling access to site resources, exposure of sensitive information, and configuration changes that can cross tenant boundaries. Cisco said its hosted SaaS environments have already been remediated, while customers running affected versions must upgrade because **no workaround is available**. Fixed releases include **3.10.8.3** and **4.0.3.17**, with the issue affecting version **3.9 and earlier**, versions before **3.10.8.3**, and versions before **4.0.3.17**. Cisco and the Canadian Centre for Cyber Security urged administrators to review the advisory and apply updates promptly; Cisco said it is not aware of active exploitation and reported that the vulnerability was identified during internal security testing.
Jun 29, 2026
Multiple vulnerabilities in **Cisco IOS** and **Cisco IOS XE** devices have exposed routers, switches, access points, and Catalyst 9000 platforms to severe compromise, including **remote code execution**, **denial of service**, **access control bypass**, **privilege escalation**, **secure boot bypass**, **cross-site scripting**, and memory corruption. Traficom highlighted newly disclosed flaws such as `CVE-2025-20334` and `CVE-2025-20363`, which may allow arbitrary code execution, and urged organizations to update affected products in line with Cisco’s version-specific advisories. The warning follows earlier real-world attacks against internet-exposed Cisco IOS XE Web GUI instances, where attackers exploited `CVE-2023-20198` and `CVE-2023-20273` to create unauthorized administrator accounts, install a backdoor implant, and seize full control of devices. Cisco Talos reported the campaign affected exposed systems internationally, with tens of thousands of vulnerable devices identified online, while Finnish authorities said some domestic devices had already been backdoored and advised restricting Web GUI access to trusted networks or removing public internet exposure entirely.
Jun 29, 2026