Loading story…
Ericsson released security updates for Packet Core Controller (PCC) to fix five vulnerabilities that can lead to privilege escalation, arbitrary code execution, information disclosure, and denial of service. The most severe issue, CVE-2025-59172, is a high-severity OS command injection flaw affecting PCC versions prior to 1.38 that could allow arbitrary code execution as root. Ericsson said the affected releases include PCC versions prior to 1.38 and, for some issues, versions prior to 1.39.
The bulletin also describes weaknesses in Configuration Management and the alarm system, including exposure of secrets through error messages, user enumeration, hardcoded credentials, and directory traversal. Ericsson said upgrading to PCC 1.38 or 1.39, depending on the vulnerability, remediates the issues, while the Canadian Centre for Cyber Security urged organizations to review Ericsson’s advisory and apply the necessary updates. Ericsson credited Spark NZ and researchers Radu Balaci and Meghna Patel of Bell Mobility with reporting the flaws.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Ericsson's July 2026 security bulletin credits Spark NZ and researchers Radu Balaci and Meghna Patel of Bell Mobility for reporting five vulnerabilities in Ericsson Packet Core Controller. The bulletin does not provide a specific date for when the reports were made.
On 2026-07-24, the Canadian Centre for Cyber Security published advisory AV26-743 about Ericsson's Packet Core Controller vulnerabilities. The notice identified affected releases prior to 1.38 and prior to 1.39 and urged administrators to review Ericsson's bulletin and apply updates.
On 2026-07-24, Ericsson published a security bulletin for Packet Core Controller and released updates addressing five vulnerabilities, including CVE-2025-59172, a high-severity OS command injection flaw. Ericsson said upgrading to PCC versions 1.38 or 1.39, depending on the CVE, remediates the issues affecting earlier releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceericsson.com
Open sourceericsson.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for two **maximum-severity** vulnerabilities in *Cisco Secure Firewall Management Center (FMC)* that can be exploited remotely by **unauthenticated** attackers via crafted HTTP requests to the web-based management interface. The issues include an **authentication bypass** (**CVE-2026-20079**) that can lead to **root access** on the underlying operating system and a **remote code execution** flaw (**CVE-2026-20131**) that allows execution of arbitrary Java code as root on unpatched systems. The Canadian Centre for Cyber Security highlighted Cisco’s advisories and urged administrators to review Cisco guidance and apply updates, noting impact to **Cisco Security Cloud Control (SCC) Firewall Management** and **Cisco Secure FMC** across versions. Cisco stated its PSIRT had **no evidence of active exploitation** and no public PoC at the time of publication, while also issuing fixes for additional vulnerabilities (including multiple high-severity issues) across Cisco firewall management and firewall platforms.
Jun 29, 2026
Cisco disclosed **CVE-2026-20230**, a server-side request forgery vulnerability in **Cisco Unified Communications Manager (Unified CM)** and **Unified CM Session Management Edition (Unified CM SME)** that can be exploited remotely without authentication. The flaw stems from improper input validation in specific HTTP requests, and Cisco said successful exploitation could let an attacker write files to the underlying operating system and later escalate privileges to **root**. Cisco assigned the issue a **Critical** security impact rating even though the CVSS v3.1 profile is listed as High severity. The vulnerability affects **Release 14** versions prior to **14SU6** and **Release 15** versions prior to **15SU5** or the relevant **COP** update. Cisco noted that exploitation requires the **WebDialer** service to be enabled, and that service is disabled by default, but Canadian authorities warned that **proof-of-concept exploit code is available** and urged organizations to review Cisco’s advisory and apply updates promptly.
Jun 29, 2026
Cisco released fixes for **two high-severity privilege-escalation vulnerabilities** in **Cisco IOS XR Software** that could allow an **authenticated, local, low-privileged user** to elevate privileges and either execute arbitrary commands as **root** or obtain full administrative control of affected routing devices. The issues were identified during Cisco internal testing and are described as independent flaws (exploitation of one is not required to exploit the other); Cisco provided software updates to remediate affected versions. One flaw, **CVE-2026-20040**, is caused by insufficient validation of user-supplied arguments to certain *CLI* commands, enabling crafted input to result in root-level command execution. The second, **CVE-2026-20046**, stems from incorrect mapping of a CLI command to task groups, allowing bypass of task-group authorization checks and granting administrative control; it specifically impacts **IOS XRv 9000**. Canada’s Centre for Cyber Security highlighted Cisco’s broader advisory set (AV26-223), which includes these **IOS XR CLI privilege escalation vulnerabilities** alongside other IOS XR denial-of-service issues and web vulnerabilities in Cisco contact center products, and urged organizations to apply vendor updates as they become available.
Jun 29, 2026