Cisco PSIRT
cisco-psirt · A · active
https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml
Cisco Product Security Incident Response Team feed (added 2026-05-08). 2026-05-08 audit: 5 dated advisories May 6 2026 (Unity Connection RCE, ISE auth bypass, etc.), primary source for Cisco vuln context that ANSSI/CERT-EU advisories often cite. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml 5 (item links are full advisory URLs with title+CVE+impact; webfetch the cisco-sa-* URL for full body). AVOID: Feed summaries already carry CVE IDs + Security Impact Rating, often enough; strip the long ?vs_f=... query string when citing.. | 2026-07-05 admiralty audit: A (vendor-psirt), Cisco's own PSIRT feed, first-party advisories for its products; feed clean and current. Status stays active. | 2026-10-14 intel run: the PSIRT RSS (https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml) reads direct and per-advisory pages read with extract; the 2026-10-07 Nexus and License On-Prem critical bundle reached the store only through NCSC.ch post 13044, so rotate it into S1 after each Cisco bundle. | 2026-10-28 (S1): `feed https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml 25` returns dated items including Interim revisions; the advisory page reads with extract (prose) and `url --direct` (vulnerable-products table, revision history).
Cited in 26 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 22).
- CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)2026-10-30
- KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network2026-10-29
- CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products2026-10-28
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-76466, Cisco Expressway-C and Expressway-E: unauthenticated root command execution on clustered devices, fixed in X15.5.20 with no workaround (CVSS 9.8), alongside same-day hardening releases for Unified CM, Unity Connection and Snort 32026-10-22
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)2026-10-21
- AA26-293A: FBI, CISA and German and UK law enforcement describe SafePay ransomware, which enters through VPN credentials and five edge-device and backup-server flaws and factory-resets backup NAS devices before encrypting2026-10-21
- CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)2026-10-15
- CVE-2026-76504, Cisco Catalyst SD-WAN Manager: one percent-encoded character in the login path skips the password check and mints an admin API session, exploited in the wild (CVSS 9.8)2026-10-02
- CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)2026-09-17
- CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)2026-09-15
- CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/432112026-09-04
- CVE-2026-20349, Cisco Secure Firewall ASA/FTD: one crafted HTTP request to the Remote Access SSL VPN reloads the device, exploitation confirmed, no workaround and a three-day KEV deadline2026-08-12
- Cisco IOS XE August 2026 hardening release, seven CVEs that each stand for a whole class of internally found bugs, no workarounds, and frontier AI models among the discovery tools2026-08-08
- CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)2026-08-04
- CVE-2026-20316: Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms active exploitation2026-07-30
- CVE-2026-20230: Cisco Unified CM WebDialer SSRF to root file write, exploited and KEV-listed; WebDialer is off by default2026-06-24
- CVE-2026-55803 / CVE-2026-55804, Drupal core: PHP object-injection chain in JSON:API, BSI-rated critical2026-06-19
- Cisco ISE CVE-2026-20181 / CVE-2026-20190: administrator-level command execution to root and an unauthenticated disclosure of hashed credentials, two independent flaws2026-06-19
- CVE-2026-20262: Cisco Catalyst SD-WAN Manager authenticated arbitrary file write, exploited and KEV-listed; Cisco says a written file could later be used to gain root2026-06-16
- CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available2026-06-06
- CVE-2026-10868, MISP: critical mass-assignment account-takeover in the EU threat-sharing platform2026-06-06
- CVE-2026-10611, MISP: OTP bypass when LDAP mixed-auth and OTP enforcement are both enabled2026-06-04
- CVE-2026-20223, Cisco Secure Workload: CVSS 10.0 zero-auth REST API grants Site Admin privileges across all tenants, no workaround2026-05-22
- CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validator2026-05-15