Security Notices
CVE-2026-76409: Cisco Nexus Dashboard hardening: Improper Limitation of a Pathname
Nexus Dashboard path handling may let a pathname escape its intended directory, but the affected file operation is undisclosed. Follow the fixed-release or migration guidance rather than assuming a restriction on one upload page resolves it.
CVE-2026-20331: Cisco ASA, FTD, and FMC hardening: Protection Mechanism Failure Vulnerabilities
Cisco's ASA, FTD and FMC hardening update groups protection-mechanism failures without detailing an individual exploit sequence. Fixed-release selection must account for affected ASA hotfixes, including builds with numerically higher suffixes.
CVE-2026-76412: Cisco Secure FMC Software Privilege Escalation to root Vulnerability
An authenticated FMC user can misuse the remote diagnostics debugger in a multistage escalation to root. Apply the specific fix and review diagnostics and privilege changes; patching does not remove privileges already granted.
CVE-2026-20332: Cisco ASA, FTD, and FMC hardening: Improper Access Control Vulnerabilities
Cisco's ASA, FTD and FMC access-control hardening category has conflicting published scores. Check affected ASA hotfixes and fixed releases, while distinguishing separately reported exploited FMC vulnerabilities from direct exploitation of this group.
CVE-2026-76413: Cisco Secure FMC Single Sign-On Token Forgery Account Vulnerability
Forged ASDM single sign-on tokens can let unauthenticated attackers log in as administrator and sustain administrator lockouts. Update FMC through the CVE-specific path and preserve token, session and lockout evidence.
CVE-2026-20333: Cisco ASA, FTD, and FMC hardening: Incorrect Comparison Vulnerabilities
Incorrect security comparisons are grouped in this ASA, FTD and FMC hardening entry. The compared values and a specific traffic bypass remain undisclosed; use the product-specific release guidance and preserve its ASA hotfix exceptions.
CVE-2026-76420: Cisco Secure FMC Software Peer Impersonation Vulnerability
When the legitimate FMC-to-FTD tunnel is down, unauthenticated peer impersonation can lead to root commands and REST API control. Preserve outage and peer activity, then apply the fix; restored connectivity does not exclude earlier compromise.
CVE-2026-20334: Cisco ASA, FTD, and FMC hardening: Coding Standards Vulnerabilities
Cisco's coding-standard hardening entry for ASA, FTD and FMC discloses no specific defect or exploit outcome. Use the product-and-release update guidance, including ASA hotfix exceptions, instead of inferring protection from build numbering alone.
CVE-2026-76423: Cisco ISE REST API Authentication Bypass Vulnerability
Unauthenticated REST API requests can read or modify ISE and ISE-PIC configuration and identity data with administrative privileges. Inventory both products, apply the CVE-specific fix, and review API exposure and activity.
CVE-2026-20335: Cisco ASA, FTD, and FMC hardening: Incorrect Calculation Vulnerabilities
Incorrect calculations can lead to unsafe security or resource decisions in Cisco ASA, FTD and FMC. Match the installed platform and release to the hardening guidance; the umbrella Critical rating is not a CVE-specific severity assignment.