Tag: cisco
-
Cisco Talos Exposes ARToken Microsoft 365 Phishing Kit
Cisco Talos uncovered ARToken, a Microsoft 365 phishing platform built for persistent access and BEC attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisco-talos-exposes-artoken-microsoft-365-phishing-kit/
-
This phishing kit looks more like BEC-as-a-service
Cisco Talos’ research on ARToken builds on what’s known about the related EvilTokens phishing-as-a-service. First seen on cyberscoop.com Jump to article: cyberscoop.com/artoken-bec-platform-cisco-talos/
-
Week in review: Fortibleed campaign’s impact on orgs, Cisco Unified CM flaw exploited
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Encrypted DNS still tells an eavesdropper where to look Encrypted DNS runs … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/28/week-in-review-fortibleed-campaigns-impact-on-orgs-cisco-unified-cm-flaw-exploited/
-
CISA sets urgent deadline to fix Cisco flaw exploited in attacks
Tags: attack, cisa, cisco, communications, cybersecurity, exploit, flaw, infrastructure, update, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) is giving federal agencies until Sunday to patch a vulnerability in Cisco Unified Communications Manager Server that is being actively exploited. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/
-
Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions
Cisco joins a growing list of security platform providers who are betting that securing the agentic workforce means turning identity into the primary control plane. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/cisco-adds-nhi-security-stack-with-astrix-widefield
-
Zero-Day-Sicherheitslücke in Cisco-Catalyst-SD-WAN
Mandiant hat neue Forschungsergebnisse veröffentlicht, die detailliert beschreiben, wie ein Bedrohungsakteur eine inzwischen gepatchte Zero-Day-Sicherheitslücke in Cisco-Catalyst-SD-WAN (CVE-2026-20245) bei einem Kommunikationsdienstleister ausgenutzt hat, um die Rechte eines kompromittierten Administratorkontos auf vollständigen Root-Zugriff auszuweiten. Da diese Geräte den Datenverkehr innerhalb des Netzwerks steuern, könnte ein Angreifer mit Root-Rechten potenziell umfassende und unbemerkte Einblicke in den internen…
-
U.S. CISA adds Cisco and PTC Windchill and FlexPLM flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco and PTC Windchill and FlexPLM flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco and PTC Windchill and FlexPLM flaws to its Known Exploited Vulnerabilities (KEV) catalog. The two flaws added to the catalog are: CVE-2026-12569 is a critical remote…
-
CVE-2026-20245 Zero-Day Exploited in Cisco Catalyst SD-WAN Manager to Gain Root Access
A newly disclosed zero-day vulnerability, CVE-2026-20245, has been exploited by a threat actor targeting Cisco Catalyst SD-WAN Manager. By exploiting a flaw in the platform’s file to upload functionality, the threat actor escalated privileges from a compromised administrative account to root access and used extensive anti-forensic measures to erase evidence of the attack. First seen on thecyberexpress.com Jump to…
-
CISA Adds Actively Exploited Cisco Unified CM Flaws to KEV Catalog
Tags: cisa, cisco, communications, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, risk, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Cisco Unified Communications Manager (Unified CM) to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation risks in enterprise communication environments. The newly listed flaw, tracked as CVE-2026-20230, involves a server-side request forgery (SSRF) vulnerability in Cisco Unified CM and Unified…
-
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw
The flaw enables server-side request forgery (SSRF) and escalates privileges to root, impacting Cisco Unified CM and Unified CM SME deployments. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/less-than-24-hours-attackers-weaponize-cisco-cucm-flaw
-
Breach Roundup: How Hackers Exploited a Cisco SD-WAN Flaw
Also, Three Ubiquiti Flaws Under Exploitation. This week, Mandiant detailed a Cisco SD-WAN hack as attackers exploited Ubiquiti flaws. London Hydro disclosed a customer data breach, researchers flagged cross-cloud bucket hijacking risks an INC ransomware leak, Texas and Gravity SMTP incidents. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-how-hackers-exploited-cisco-sd-wan-flaw-a-32080
-
Malicious hackers exploit Cisco zero-day for highest access level at communications service provider
Mandiant detailed the incident in a blog post Wednesday, but it’s unclear who was behind it or if they managed to get broad visibility into the victim’s internal traffic. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisco-sd-wan-zero-day-exploit-communications-provider/
-
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited Months Before Disclosure
Hackers exploited Cisco Catalyst SD-WAN flaw CVE-2026-20245 as a zero-day months before disclosure, enabling privileged command execution. Google-owned Mandiant reported that an unknown threat actor exploited Cisco Catalyst SD-WAN vulnerability CVE-2026-20245 (CVSS base score of 7.8) as a zero-day at least two months before it was publicly disclosed. The flaw allows an authenticated attacker with…
-
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access
New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/
-
Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure
Researchers believe rogue peering was used to connect to the victim’s SD-WAN devices to gain admin privileges and root-level access. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/attackers-hit-cisco-sd-wan-flaw-2-months-before-disclosure
-
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant.The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.8), allows an authenticated, local attacker to execute arbitrary commands with elevated privileges First seen…
-
Cisco Vulnerability Exploited Months Before Disclosure, Google Warns
A high-severity flaw in Cisco Catalyst SD-WAN Manager disclosed in early June was exploited as early as March First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisco-vulnerability-exploited/
-
CVE-2026-20262 erlaubt Rechteausweitung durch Datei-Upload – Aktiv ausgenutzte Lücke im Cisco SD-WAN Manager gibt Root-Zugriff
First seen on security-insider.de Jump to article: www.security-insider.de/cisco-sd-wan-manager-cve-2026-20262-root-zugriff-a-4b5a04fcc33f1f4144727d80f9c3d037/
-
Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild
Attackers exploit Cisco Unified CM flaw (CVE-2026-20230) allowing unauth HTTP requests to trigger SSRF, write files, and gain root access Cisco Unified Communications Manager has a serious vulnerability, tracked as CVE-2026-20230 (CVSS score of 8.6), that attackers are already exploiting. The flaw, caused by improper validation of certain HTTP requests, allows a remote attacker without…
-
Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230)
CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/24/cisco-unified-cm-flaw-exploited-to-drop-webshells-cve-2026-20230/
-
Cisco Unified Communications Manager Flaw Exposes Systems to SSRF Attacks and Root Access
Cisco has disclosed a critical server-side request forgery (SSRF) vulnerability affecting its Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). This vulnerability could enable unauthenticated remote attackers to write files to the underlying operating system and potentially escalate their privileges to root. Identified as CVE-2026-20230 and documented in…
-
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME).The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, remote First seen…
-
Legacy networks can no longer support the new AI workforce
At Cisco Connect 2026 Singapore, tech leaders and policymakers warn that businesses must modernise their IT infrastructure and governance frameworks to pave the way for agentic AI First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366645003/Cisco-Legacy-networks-can-no-longer-support-the-new-AI-workforce
-
Cisco plans to acquire WideField Security
Tags: ciscoFirst seen on scworld.com Jump to article: www.scworld.com/brief/cisco-plans-to-acquire-widefield-security
-
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/
-
FortiBleed Is ‘Tip of the Iceberg’ of Edge Device Targeting
Threat Actor Harvesting Other Credentials; Experts See Many More Scans for SSL-VPNs. Discovery of the Fortinet credential-harvesting campaign tracked as FortiBleed appears to be the tip of the iceberg of edge device targeting, with honeypot telemetry revealing VPN and edge devices from Check Point, Cisco, Ivanti/Pulse, Palo Alto, OpenVPN and SonicWall also being top targets.…
-
10 Major Cyberattacks And Data Breaches In 2026 (So Far)
Major cyberattacks and data breaches in 2026 so far include attacks against Cisco and Fortinet devices as well as Microsoft environments, while AI-driven vulnerability discovery showed signs of increasing. First seen on crn.com Jump to article: www.crn.com/news/security/2026/10-major-cyberattacks-and-data-breaches-in-2026-so-far
-
Cisco Bets On WideField Security Acquisition To Tackle Agentic AI Security Gap
Cisco’s planned acquisition of WideField Security comes on the heels of its acquisitions of Galileo and Astrix Security to expand its networking, security, and AI capabilities. First seen on crn.com Jump to article: www.crn.com/news/security/2026/cisco-bets-on-widefield-security-acquisition-to-tackle-agentic-ai-security-gap
-
Cisco fixed a critical ISE vulnerability that lets attackers to gain root access
Cisco addressed CVE-2026-20181, a critical ISE vulnerability that lets authenticated admins execute commands and gain root access. Cisco addressed a critical command execution vulnerability, tracked as CVE-2026-20181 (CVSS score of 9.1), affecting Identity Services Engine (ISE) and ISE-PIC. The flaw stems from improper validation of user-supplied input, allowing an authenticated attacker with administrative credentials to…
-
Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model
Cisco Talos detailed a new approach to reverse engineering that pairs local AI agents with traditional analysis tools like the VB6 disassembler vbdec. Instead of awkwardly bolting AI onto the software, vbdec exposes its parsed data through a live COM interface. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/scripting-the-disassembler/