Loading story…
A vulnerability in the TACACS+ protocol implementation in Cisco IOS and IOS XE Software allows unauthenticated, remote attackers to view sensitive data or bypass authentication. The flaw arises from improper verification of the required TACACS+ shared secret, enabling attackers to intercept unencrypted TACACS+ messages or impersonate the TACACS+ server to accept arbitrary authentication requests. Successful exploitation could result in unauthorized access to affected devices or exposure of sensitive information. Cisco has released software updates and workarounds to address this issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-20160 was published in vulnerability tracking as a high-severity issue described as an unauthenticated data disclosure and authentication bypass affecting Cisco TACACS+. This reflects broader public cataloging of the vulnerability after Cisco's disclosure.
Cisco published a security advisory for a TACACS+ authentication bypass vulnerability affecting Cisco IOS and IOS XE Software. The advisory marks the public disclosure of the issue and identifies affected Cisco products.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco disclosed a critical vulnerability (CVE-2025-20334) in the HTTP API subsystem of IOS XE Software that allows remote attackers to execute arbitrary commands with root privileges. The flaw arises from insufficient input validation, enabling exploitation either by an authenticated attacker making crafted API calls or by tricking an authenticated administrator into clicking a malicious link. Cisco has released software updates to address the vulnerability, but no workarounds are available. The vulnerability affects multiple Cisco IOS XE products and poses a significant risk due to the potential for full system compromise.
Jun 29, 2026
Multiple vulnerabilities in **Cisco IOS** and **Cisco IOS XE** devices have exposed routers, switches, access points, and Catalyst 9000 platforms to severe compromise, including **remote code execution**, **denial of service**, **access control bypass**, **privilege escalation**, **secure boot bypass**, **cross-site scripting**, and memory corruption. Traficom highlighted newly disclosed flaws such as `CVE-2025-20334` and `CVE-2025-20363`, which may allow arbitrary code execution, and urged organizations to update affected products in line with Cisco’s version-specific advisories. The warning follows earlier real-world attacks against internet-exposed Cisco IOS XE Web GUI instances, where attackers exploited `CVE-2023-20198` and `CVE-2023-20273` to create unauthorized administrator accounts, install a backdoor implant, and seize full control of devices. Cisco Talos reported the campaign affected exposed systems internationally, with tens of thousands of vulnerable devices identified online, while Finnish authorities said some domestic devices had already been backdoored and advised restricting Web GUI access to trusted networks or removing public internet exposure entirely.
Jun 29, 2026