CVE-2026-76459 is a critical vulnerability in Cisco NX-OS Software involving out-of-bounds write issues. These flaws were discovered during an internal security review by Cisco's engineering team and are categorized under CWE-787. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided in the available data.
CVE-2026-76471 is a critical heap-based buffer overflow vulnerability in the NX-API feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to send crafted HTTP requests to the NX-API, potentially leading to arbitrary code execution with root privileges or denial of service via device reloads.
CVE-2026-76455 is a critical vulnerability in Cisco NX-OS Software involving improper access control. Cisco identified this issue during an internal security review and addressed it through a software hardening release. The vulnerability is classified under CWE-284, indicating weaknesses in access control mechanisms. It has a high CVSS score of 9.8, reflecting its potential impact on confidentiality, integrity, and availability without requiring user interaction or privileges. No specific affected versions or patch details are provided in the available data.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under the Common Weakness Enumeration (CWE) CWE-125.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used in a command issue that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
CVE-2026-76465 is a critical vulnerability in the MPLS OAM feature of Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending a crafted MPLS echo-request packet. The flaw arises from improper validation of these packets, potentially leading to process crashes and device reloads.
Cisco Jabber for Android versions before 15.3.1.311364 contain a path traversal vulnerability that allows a malicious app without permissions to write files into Jabber's private data directories. This is achieved by exploiting an exported activity and unsanitized input used in file path construction, enabling attackers to place attacker-controlled content in sensitive directories without user interaction.
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.
This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
CVE-2026-76453 is a high-severity vulnerability in Cisco NX-OS Software involving improper neutralization issues classified under CWE-707. Cisco conducted an internal security review leading to a software hardening release addressing multiple vulnerabilities, including this one. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided in the available data.
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.
This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do.
CVE-2026-20362 is a Server-Side Request Forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse. It allows an unauthenticated remote attacker to send crafted HTTP requests that could lead to limited sensitive information disclosure from services associated with the affected device. The vulnerability arises from improper input validation of specific HTTP requests. It has a CVSS score of 7.2, indicating high severity. No patch or remediation information is currently provided.
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality.
To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.