Threats tagged 'cisco'

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC versions 3.1 and 3.1.0 allows an authorization bypass regardless of device configuration. This issue was publicly disclosed on November 4, 2026. Specific fixed software versions are referenced in the vendor advisory but not detailed here.

A remote code execution vulnerability exists in Cisco UCS Central Software version 2.0. This flaw affects the software regardless of device configuration. No CVSS score or detailed impact information is provided in the available data.

A cross-site scripting (XSS) vulnerability affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified CM SME in versions 14 and 15. This vulnerability exists regardless of device configuration. No CVSS score or detailed impact information is provided in the available data.

A critical remote code execution vulnerability exists in Cisco Snort's sf_unfold_header component. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems. The vulnerability has been assigned CVE-2026-20043 and carries a high severity rating of 9.8 by the Zero Day Initiative.

This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.

Cisco Talos has identified a new Windows-based command-and-control (C2) framework named NIK C2 that integrates AI directly into its attack chain. This Go-based implant enables adversaries to dump credentials, capture keystrokes, and deploy screen-locking ransomware. It uses an embedded OpenAI model to analyze harvested data in real time, funding API requests by hijacking the victim's own OpenAI API keys. This integration allows continuous data collection and exploitation without offline delays, turning compromised hosts into active operational assets. The use of victim API keys also masks attacker infrastructure, complicating detection and incident response. Defenders are advised to implement continuous behavioral monitoring and update endpoint defenses accordingly.

Cisco has open sourced Project Quarry, a neurosymbolic rule language designed to detect AI agent attacks that manifest only across sequences of individually benign actions. Traditional security controls often fail to detect such attacks because they evaluate actions in isolation rather than as connected sequences. Quarry combines machine learning classifiers and rule-based checks to identify suspicious patterns in AI agent behavior over time. It supports runtime guardrails, post-hoc analytics, and incident response, integrating with Cisco's AI Security & Safety Framework. The project aims to become a shared standard for detecting AI-agent threats and to enable defenders worldwide to rapidly develop and share detection rules, countering attackers' use of AI to create sophisticated multi-step attacks.

A critical zero-day vulnerability (CVE-2026-20127) in Cisco SD-WAN controllers has been exploited by a sophisticated threat actor linked to the Volt Typhoon 'Silent Train' network. The vulnerability allows remote attackers to bypass authentication and gain administrative access to SD-WAN controllers without credentials. Attackers deployed KeyDrift malware to maintain persistent access and steal encryption keys, targeting organizations in sectors such as defense, aerospace, telecommunications, and critical infrastructure. The campaigns have been ongoing since at least late 2025, affecting entities primarily in the United States, with a focus on regions including Hawaii, California, and Texas.

NIK C2 is a newly observed AI-enabled command-and-control (C2) framework targeting Windows systems. It features a Go-based implant that provides persistent remote access with capabilities including credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and deployment of screen-locking ransomware demanding cryptocurrency payments. The implant uniquely integrates the OpenAI Chat Completions API, allowing threat actors to analyze harvested data using AI in real time within the compromised session. This integration collapses traditional offline data processing delays, complicating detection and response efforts. The implant communicates over encrypted channels with resilient fallback mechanisms and has been observed in multiple evolving versions compiled no earlier than late 2024. Active infrastructure associated with NIK C2 has been identified in the wild, confirming its operational status.

CVE-2026-76418 is a high-severity vulnerability in Cisco Secure Firewall ASA and FTD software affecting the Remote Access SSL VPN service. It allows unauthenticated remote attackers to cause the firewall device to restart unexpectedly, disrupting availability. The flaw stems from logic errors in tunnel groups configured with secondary authentication. Cisco has released patches to fix this issue and recommends upgrading. No workarounds exist, though disabling secondary authentication or tunnel group lists can reduce exposure but weaken security. This is the second zero-day exploited in Cisco ASA and FTD VPN services in recent months.

Cisco Talos identified UAT-11473, an advanced persistent threat actor exploiting CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller instances. The attacker deployed a custom malware framework named KeyDrift, designed to persistently access and exfiltrate sensitive keying material from SD-WAN control-plane processes. KeyDrift includes components such as PolyFlame, which injects into legitimate controller processes to intercept decrypted control traffic, and LittleFilch, which collects and stages keying material for exfiltration. The malware operates stealthily within the controller environment, leveraging modified service scripts and runit service paths for persistence and execution. Targeting spans space and satellite services, defense, aerospace, and policy research sectors. The threat actor's infrastructure overlaps with the Volt Typhoon group’s covert network.

A vulnerability exists in Cisco Secure Firewall ASA Software and Secure FTD Software versions 9.16, 9.16.1, and 9.16.1.28 when the SSL remote access VPN login service is reachable and secondary authentication is configured in the tunnel group scope. The vulnerability affects configurations where the webvpn keyword is enabled on at least one interface and secondary authentication server groups are set in tunnel groups, including the default group DefaultWEBVPNGroup. This exposure occurs even if the tunnel-group-list is disabled, and a successful VPN login is not required to reach the affected processing path.

This is an advance notification from Cisco regarding the publication of security advisories scheduled for November 4, 2026. The notification provides references to Cisco's security vulnerability disclosure policies and instructions for obtaining fixed software and security information. No specific vulnerabilities, impacts, or affected versions are detailed in this notification.

This content is an interview and career retrospective with security researcher Ryan Fetterman, discussing his journey from federal security operations centers to his role at Cisco Talos. It covers his experiences with detection engineering, host-based analytics, and challenges faced during advanced persistent threat (APT) incident investigations. The discussion includes insights into evolving attacker tactics and the importance of sustainable career development in cybersecurity.

Cisco is investigating the impact of an emergency distrust of eMudhra root and intermediate certificate authorities on its product line. The advisory lists numerous Cisco products under active investigation to determine if they are affected. As of now, no specific affected versions or confirmed vulnerabilities have been identified. Cisco will update the advisory as the investigation progresses.

Cisco released patches addressing 34 vulnerabilities across multiple products including Expressway Series, IOS XR, Snort 3, and Unified Communications. The vulnerabilities include critical remote code execution, authentication bypass, and cross-site scripting issues. Notably, a critical remote code execution flaw in Expressway Series could allow attackers to execute arbitrary commands as root. Other critical issues affect Unified Communications and Snort 3 products. Cisco is not aware of any active exploitation of these vulnerabilities in the wild.

A stack-based buffer overflow vulnerability in Cisco Snort's OLE VBA decompression component allows remote attackers to execute arbitrary code without authentication. The vulnerability is identified as CVE-2026-20218 and has a high severity rating with a CVSS score assigned by ZDI of 8.1. No affected versions or patch information are provided in the available data.

Multiple vulnerabilities affect various Cisco Unified Communications products including Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. The advisory references affected software versions 14 and 15. Specific details on the vulnerabilities and their impact are not provided in the input data.

Multiple vulnerabilities have been identified in Cisco Expressway-C and Expressway-E products, affecting both virtual and appliance versions. These vulnerabilities impact versions 8.5, 8.5.1, and 8.5.3. The advisory references a security hardening release scheduled for October 2026, with fixed software versions noted in the vendor advisory. No specific technical details, CVSS scores, or exploitation information are provided in the input data.

Two critical unauthenticated remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core versions since 5.4. These flaws, collectively dubbed “php2shell,” can be triggered by a plain HTTP request before any application code runs. The vulnerabilities arise from improper handling of out-of-memory conditions and use-after-free stale internal states. The impact spans the entire PHP ecosystem, including popular applications like WordPress, Drupal, Magento, and others. PHP 8.1 and older versions are end-of-life and will not receive patches, while PHP 8.2 support ends December 31, 2026. No active exploitation has been observed as of October 21, 2026. Cisco Talos recommends immediate upgrading to fixed releases and provides intrusion prevention signatures for detection. Some configuration mitigations may reduce exposure but do not fully protect against these vulnerabilities.