Security Notices
CVE-2026-76434: Cisco ISE Arbitrary File Read Vulnerability
An ISE or ISE-PIC administrator can read arbitrary files through certificate import. Install the CVE-specific update and assess earlier import requests; the description supports file disclosure, not command execution from importing a certificate.
CVE-2026-76438: Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability
A low-privilege BroadWorks CommPilot user can change configuration on selected pages through missing authorization checks. Choose the fix for the installed CommPilot or bundled Application Server package; authentication is still required.
CVE-2026-76439: Cisco ISE Event Injection Vulnerability
Unauthenticated guest-portal requests can forge ISE endpoint posture-status events. Apply the specific update and preserve posture history; the reviewed description establishes status manipulation, not operating-system command execution despite the inconsistent heading.
CVE-2026-20330: Cisco ASA, FTD, and FMC hardening: Improper Neutralization Vulnerabilities
ASA, FTD and FMC hardening covers structured data handled unsafely between components, without a disclosed parser or injection path. Match the release table and ASA hotfix exceptions rather than relying on a higher build number.
CVE-2026-76409: Cisco Nexus Dashboard hardening: Improper Limitation of a Pathname
Nexus Dashboard path handling may let a pathname escape its intended directory, but the affected file operation is undisclosed. Follow the fixed-release or migration guidance rather than assuming a restriction on one upload page resolves it.
CVE-2026-20331: Cisco ASA, FTD, and FMC hardening: Protection Mechanism Failure Vulnerabilities
Cisco's ASA, FTD and FMC hardening update groups protection-mechanism failures without detailing an individual exploit sequence. Fixed-release selection must account for affected ASA hotfixes, including builds with numerically higher suffixes.
CVE-2026-76412: Cisco Secure FMC Software Privilege Escalation to root Vulnerability
An authenticated FMC user can misuse the remote diagnostics debugger in a multistage escalation to root. Apply the specific fix and review diagnostics and privilege changes; patching does not remove privileges already granted.
CVE-2026-20332: Cisco ASA, FTD, and FMC hardening: Improper Access Control Vulnerabilities
Cisco's ASA, FTD and FMC access-control hardening category has conflicting published scores. Check affected ASA hotfixes and fixed releases, while distinguishing separately reported exploited FMC vulnerabilities from direct exploitation of this group.
CVE-2026-76413: Cisco Secure FMC Single Sign-On Token Forgery Account Vulnerability
Forged ASDM single sign-on tokens can let unauthenticated attackers log in as administrator and sustain administrator lockouts. Update FMC through the CVE-specific path and preserve token, session and lockout evidence.
CVE-2026-20333: Cisco ASA, FTD, and FMC hardening: Incorrect Comparison Vulnerabilities
Incorrect security comparisons are grouped in this ASA, FTD and FMC hardening entry. The compared values and a specific traffic bypass remain undisclosed; use the product-specific release guidance and preserve its ASA hotfix exceptions.