Loading story…
Cisco released fixes for nine vulnerabilities across Nexus 9000 switches, IOS XR, SIP software, and selected collaboration endpoints. The most severe, CVE-2026-20212 (CVSS 9.8), affects certain Silicon One-based Nexus 9000 switches: unauthenticated remote attackers can send crafted traffic to TCP ports 43210 or 43211 exposed through the default Layer 3 VRF and execute code as root. Cisco also patched critical IOS XR and Nexus flaws, including CVE-2026-20274 and CVE-2026-20279, which can enable remote code execution or authentication bypass, and fixed the high-severity phone denial-of-service issue CVE-2026-20281.
Cisco separately warned that CVE-2026-20354 and CVE-2026-20355 remain unpatched in Secure Email appliances running AsyncOS 16.5.0 or earlier with S/MIME enabled. A man-in-the-middle attacker able to intercept and alter gateway traffic could recover plaintext from encrypted email communications. Cisco reported no known public exploitation of the patched flaws or the Secure Email issues; organizations should promptly deploy applicable NX-OS, IOS XR, and other Cisco updates, while restricting access to ports 43210 and 43211 with infrastructure ACLs or port blocks until Nexus systems can be upgraded.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco published advisory cisco-sa-n9k-s1-rce-EH8dEtr and released fixed NX-OS software for CVE-2026-20212, a CVSS 9.8 unauthenticated remote-code-execution flaw in certain Nexus 9000 switches with Silicon One ASICs. The flaw exposed TCP ports 43210 and 43211 through the default Layer 3 VRF configuration and could permit code execution as root; Cisco said it knew of no public exploitation.
Cisco released Live Protect shield lp00031 as a temporary mitigation to block exploitation attempts against CVE-2026-20212 and published Snort Rule 67005 to detect associated activity. Cisco also provided an infrastructure ACL workaround to block traffic to affected local switch addresses on TCP ports 43210 and 43211.
Cisco fixed CVE-2026-20281, a high-severity denial-of-service vulnerability affecting specified Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices using SIP. An unauthenticated attacker could send continuous crafted HTTP packets to cause a denial-of-service condition.
Cisco released patches for seven critical IOS XR vulnerabilities, including CVE-2026-20274 and CVE-2026-20279, both rated CVSS 9.8. The issues could enable outcomes including remote code execution, authentication bypass, and code injection, and Cisco said it was unaware of exploitation.
Cisco disclosed CVE-2026-20354 and CVE-2026-20355, two publicly disclosed medium-severity flaws affecting Secure Email devices running AsyncOS 16.5.0 or earlier with S/MIME enabled. A man-in-the-middle attacker could intercept and modify gateway traffic to recover plaintext from encrypted communications; Cisco reported no known in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecsirt.sk
Open sourcecysecurity.news
Open sourcesocprime.com
Open sourcesecurityweek.com
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for multiple products after disclosing at least 15 vulnerabilities, including **eight critical** issues and several high-severity flaws. The most serious bugs affect **Cisco Secure Workload** and **Cisco Crosswork Data Gateway**, where vulnerabilities rated up to `CVSS 10.0` could allow **authentication bypass, remote code execution, path traversal, file overwrite or deletion, data manipulation, and filesystem compromise**. Cisco issued fixes including **Secure Workload 4.0.4.16 and 3.10.9.1** and patches for **Crosswork 7.2.1-SP**, while urging customers to follow product-specific security bulletins and upgrade affected systems promptly. Cisco also patched a high-severity **XML External Entity** flaw in **Cisco BroadWorks**, tracked as `CVE-2026-20320`, which could let unauthenticated attackers read sensitive configuration data and files through the OCI-P provisioning service; affected BroadWorks releases earlier than `RI.2026.07` should be upgraded because no workaround is available. Additional fixes were issued for products including **Network Controller**, **Planning**, **Packaged Contact Center Enterprise**, **RoomOS**, **Industrial Ethernet 1000 Series Switches**, **Unified Intelligence Center**, and **Cisco Talos Intelligence for Enterprise Security Cloud**. Cisco said it had **no evidence of active exploitation** at the time of disclosure.
Aug 24, 2026
Cisco disclosed five remotely reachable, unauthenticated vulnerability groupings in Cisco Secure Email Gateway (AsyncOS) and Cisco Secure Email and Web Manager: `CVE-2026-76440`, `CVE-2026-76441`, `CVE-2026-20353`, `CVE-2026-76442`, and `CVE-2026-76443`. The most severe issue, `CVE-2026-76443`, stems from improper neutralization of input and could enable remote execution of crafted input; `CVE-2026-76441` and `CVE-2026-20353` are each rated CVSS 9.8 and can affect confidentiality, integrity, and availability without authentication or user interaction. The flaws affect appliances regardless of configuration, and Cisco has provided no workarounds; organizations must upgrade to fixed releases. Cisco reported no known public exploit code or exploitation for the five newly disclosed vulnerabilities, but defenders should prioritize patching because the related AsyncOS flaw `CVE-2026-76461` is under active exploitation and has been added to CISA's Known Exploited Vulnerabilities catalog.
Sep 15, 2026
Cisco disclosed and patched multiple high-severity vulnerabilities across enterprise products, led by **Cisco Unity Connection** flaws that could enable **remote code execution** and **server-side request forgery**. **CVE-2026-20034** affects the web-based management interface and stems from insufficient validation of user-supplied input, allowing an authenticated remote attacker to send a crafted API request and execute arbitrary code as `root`, potentially fully compromising the device. Cisco also fixed **CVE-2026-20035**, an unauthenticated SSRF issue in the Web Inbox UI, and said successful exploitation of the Unity Connection bugs could result in code execution, SSRF, or denial-of-service conditions. Cisco also addressed **CVE-2026-20188**, an uncontrolled resource consumption flaw in **Cisco Crosswork Network Controller** and **Cisco Network Services Orchestrator** caused by insufficient rate limiting on incoming network connections. An unauthenticated remote attacker could exhaust connection resources and make affected systems unresponsive until they are manually rebooted. Cisco said Crosswork Network Controller **7.1 and earlier** are affected while **7.2** is not; NSO **6.3 and earlier** and the **6.4** branch are affected, with fixes starting in **6.4.1.3** and **6.5 or later** unaffected. Cisco reported no public proof-of-concept or active exploitation for the disclosed issues and urged customers to upgrade because no workaround is available for the DoS flaw.
Jul 23, 2026