Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
14 / 111 results
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active exploit for file write/RCE
Cisco Secure Email Gateway (formerly IronPort). Specific vulnerable versions not disclosed in available data. Affects on-premises appliances.
criticalbug_reportVulnerabilityCisco Secure Email Gateway RCE exploited in wild; root access via AMP
Cisco Secure Email Gateway (physical and virtual) running AsyncOS 15.5 before 15.5.5-014, all 16.0 versions, and 16.5 before 16.5.0-780, with AMP File Reputation service enabled and Content Scanner Tools earlier than 25.3.0.5525.
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active attack via file write RCE flaw
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS versions prior to 15.5.5-014 or 16.5.0-780, with File Reputation service enabled and Content Scanner Tools package older than version 25.3.0.5525.
criticalbug_reportVulnerabilityCisco SEG zero-day CVE-2026-76519 exploited for root command execution
Cisco Secure Email Gateway (SEG) appliances with File Reputation service enabled and Content Scanner Tools version earlier than 25.3.0.5525. Approximately 300 instances exposed online. Cloud instances already mitigated by Cisco.
criticalbug_reportVulnerabilityFive critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switches
Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass under active exploitation
Cisco Catalyst SD-WAN Manager (specific versions not disclosed in source). Vulnerability allows unauthenticated remote attackers to gain administrative API access.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalbug_reportVulnerabilityCisco SD-WAN Manager zero-day exploited: auth bypass grants admin API access
Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
highbug_reportVulnerabilityCisco ISE auth bypass zero-day exploited; AI agent RCE and browser malware
Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE.
criticalbug_reportVulnerabilityCERT.BE warns of critical Cisco vulnerabilities requiring urgent patching
Cisco products (specific products, versions, and CVE identifiers not disclosed in available advisory text)
criticalbug_reportVulnerabilityCisco ISE max-severity auth bypass zero-day exploited in the wild
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
criticalbug_reportVulnerabilityCisco Secure Email Gateway zero-day exploited; root RCE via crafted email
Cisco Secure Email Gateway (SEG) appliances running vulnerable versions of AsyncOS Software. CVE-2026-76461 affects all physical and virtual appliances regardless of configuration. Over 400 internet-exposed instances tracked by Shadowserver.