CVE-2026-20282

Cisco Identity Services Engine (ISE) contains an authenticated write vulnerability caused by insufficient validation of user-supplied input . An attacker with valid administrative credentials can send a crafted HTTP request to gain write access to the underlying operating system . Cisco assigned ...

CVE-2026-20323

CVE-2026-20323 affects the sftunnel inter-device communication protocol in Cisco Secure FMC Software and Cisco Secure FTD Software . The root cause is improper management of the TLS certificate used for the sftunnel management connection. An unauthenticated, adjacent attacker with high attack com...

CVE-2026-76412

Cisco Secure Firewall Management Center (FMC) Software is affected by an authenticated privilege escalation vulnerability in its remote diagnostics debugger . The root cause is an error in the privilege-level check performed when a user invokes remote diagnostics. An attacker with valid (low-priv...

CVE-2026-20283

A command injection vulnerability in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The root cause is insufficient validation of user-supplied input in IPsec Open API ca...

CVE-2026-92527

A server-side request forgery (SSRF) vulnerability affects chatwoot versions up to 4.17.1 in the Shopify OAuth component, specifically in the file callbacks_controller.rb . The root cause involves manipulation of an unknown function within that file, enabling a remote attacker with low privileges...

CVE-2026-20333

CVE-2026-20333 affects Cisco Secure Adaptive Security Appliance (ASA) Software , Secure Firewall Threat Defense (FTD) Software , and Secure Firewall Management Center (FMC) Software . The vulnerability stems from incorrect comparison conditions (classified under CWE-697 ), identified during Cisco...

CVE-2026-76425

Cisco ISE (Identity Services Engine) contains a SQL injection vulnerability in its APIs. The root cause is insufficient validation of certain parameters that are concatenated directly into an SQL query. An authenticated, remote attacker with administrative credentials can send a crafted request c...

CVE-2026-20334

CVE-2026-20334 affects Cisco Secure Adaptive Security Appliance Software , Cisco Secure Firewall Threat Defense (FTD) Software , and Cisco Secure Firewall Management Center (FMC) Software . The vulnerabilities stem from improper adherence to coding standards grouped under CWE-710 , discovered dur...

CVE-2026-20284

CVE-2026-20284 affects the SXP REST API component of Cisco Identity Services Engine (ISE) . The root cause is insufficient validation of user-supplied input in REST API calls, enabling an authenticated, remote attacker to perform SQL injection against the underlying database. A successful exploit...

CVE-2026-76424

Cisco ISE REST API contains an arbitrary file access vulnerability caused by insufficient validation in file operations . An authenticated remote attacker holding valid administrative credentials can upload or copy files using a crafted path, allowing files to be placed at arbitrary locations on ...

CVE-2026-20332

CVE-2026-20332 covers improper access control vulnerabilities (CWE-284) identified during an internal security review of Cisco Secure Adaptive Security Appliance (ASA) Software , Secure Firewall Threat Defense (FTD) Software , and Secure Firewall Management Center (FMC) Software . Cisco addressed...

CVE-2026-20344

Cisco Secure Firewall Management Center (FMC) Software contains a SQL injection vulnerability in its web-based management interface, caused by insufficient validation of user-supplied input. An authenticated remote attacker holding the Security Approver , Access Admin , or Network Admin role can ...

CVE-2026-20154

CVE-2026-20154 affects Cisco Secure Firewall ASA and FTD Software. The root cause is improper rate limiting for syslog message 419002. An unauthenticated remote attacker can trigger a denial of service by sending a flood of TCP SYN packets , causing high CPU utilization and performance degradatio...

CVE-2026-20360

Cisco Nexus Dashboard is affected by CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and insecure handling issues, as part of a software hardening release from Cisco's internal security review. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, and...

CVE-2026-20343

A vulnerability in a critical API of Cisco Secure Firewall Management Center (FMC) Software arises because the API lacks authentication . An unauthenticated, remote attacker can exploit it by repeatedly invoking the API, potentially downloading sensitive files that should be restricted and consum...

CVE-2026-20222

CVE-2026-20222 affects the EIGRP implementation in Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software. The root cause is improper resource management when processing EIGRP update messages. An unauthenticated, adjacent attacker can send crafted EIGRP updates...

CVE-2026-20247

CVE-2026-20247 affects Cisco Identity Services Engine (ISE) and allows an unauthenticated, remote attacker to perform SQL injection by sending a crafted request. The root cause is improper validation of user-supplied input . A successful exploit enables the attacker to modify data in the underlyi...

CVE-2026-20135

Cisco Secure Firewall Threat Defense (FTD) Software is vulnerable to a denial of service (DoS) via its TLS 1.3 implementation . The root cause is improper buffer management during TLS 1.3 connections. An unauthenticated, remote attacker can trigger a DoS by sending a crafted TLS 1.3 packet to a T...

CVE-2026-76460

A critical authentication bypass (CVSS 10.0) in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) stems from insufficient authentication control on an API endpoint—described as incorrect use of privileged APIs. An unauthenticated, remote attacker can exploit ...

CVE-2026-20352

CVE-2026-20352 affects the RADIUS feature of Cisco Identity Services Engine (ISE) . The root cause is improper handling of certain RADIUS requests, allowing an unauthenticated, remote attacker to send a crafted RADIUS request directly to the device and trigger a denial of service that renders the...