CVE-2026-76425: Cisco ISE SQL Injection Vulnerability
An ISE administrator can inject SQL through API parameters to read database content and cause server-side requests. Apply the specific fix and examine outbound traffic as well as data access; root execution is not established.
CVE-2026-76424: Cisco ISE Arbitrary File Access Vulnerability
An ISE administrator can use crafted REST API paths to place files and potentially execute root commands. Apply the ISE-specific fix and investigate files already uploaded or copied; a successful update does not establish their removal.
CVE-2026-76423: Cisco ISE REST API Authentication Bypass Vulnerability
Unauthenticated REST API requests can read or modify ISE and ISE-PIC configuration and identity data with administrative privileges. Inventory both products, apply the CVE-specific fix, and review API exposure and activity.
CVE-2026-76420: Cisco Secure FMC Software Peer Impersonation Vulnerability
When the legitimate FMC-to-FTD tunnel is down, unauthenticated peer impersonation can lead to root commands and REST API control. Preserve outage and peer activity, then apply the fix; restored connectivity does not exclude earlier compromise.
CVE-2026-76413: Cisco Secure FMC Single Sign-On Token Forgery Account Vulnerability
Forged ASDM single sign-on tokens can let unauthenticated attackers log in as administrator and sustain administrator lockouts. Update FMC through the CVE-specific path and preserve token, session and lockout evidence.
CVE-2026-76412: Cisco Secure FMC Software Privilege Escalation to root Vulnerability
An authenticated FMC user can misuse the remote diagnostics debugger in a multistage escalation to root. Apply the specific fix and review diagnostics and privilege changes; patching does not remove privileges already granted.
CVE-2026-76409: Cisco Nexus Dashboard hardening: Improper Limitation of a Pathname
Nexus Dashboard path handling may let a pathname escape its intended directory, but the affected file operation is undisclosed. Follow the fixed-release or migration guidance rather than assuming a restriction on one upload page resolves it.
CVE-2026-20361: Cisco Nexus Dashboard hardening: SQL Injection
Unsafe SQL input handling is grouped with disclosure and unsafe defaults in this Nexus Dashboard hardening entry. Follow the Dashboard update guidance; no particular query endpoint or operating-system control is established by the brief record.
CVE-2026-20360: Cisco Nexus Dashboard hardening: Information Exposure & Insecure Handling
Nexus Dashboard hardening covers sensitive-information exposure and insecure handling without naming a particular data store. Apply the Dashboard-specific update guidance; the category does not establish theft of a particular credential or dataset.
CVE-2026-20352: Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
Crafted RADIUS requests can make an ISE node unavailable and block new endpoint authentication. Check each Policy Service Node and Session Services state; disabling that service on a RADIUS node also disables legitimate RADIUS access.