Security Notices
CVE-2026-20334: Cisco ASA, FTD, and FMC hardening: Coding Standards Vulnerabilities
Cisco's coding-standard hardening entry for ASA, FTD and FMC discloses no specific defect or exploit outcome. Use the product-and-release update guidance, including ASA hotfix exceptions, instead of inferring protection from build numbering alone.
CVE-2026-76423: Cisco ISE REST API Authentication Bypass Vulnerability
Unauthenticated REST API requests can read or modify ISE and ISE-PIC configuration and identity data with administrative privileges. Inventory both products, apply the CVE-specific fix, and review API exposure and activity.
CVE-2026-20335: Cisco ASA, FTD, and FMC hardening: Incorrect Calculation Vulnerabilities
Incorrect calculations can lead to unsafe security or resource decisions in Cisco ASA, FTD and FMC. Match the installed platform and release to the hardening guidance; the umbrella Critical rating is not a CVE-specific severity assignment.
CVE-2026-76424: Cisco ISE Arbitrary File Access Vulnerability
An ISE administrator can use crafted REST API paths to place files and potentially execute root commands. Apply the ISE-specific fix and investigate files already uploaded or copied; a successful update does not establish their removal.
CVE-2026-20336: Cisco ASA, FTD, and FMC hardening: Resource Lifetime Management Vulnerabilities
Cisco groups resource-lifetime flaws across ASA, FTD and FMC without describing an individual attack path. The article separates conflicting source scores and affected-hotfix guidance from an exploitation footnote belonging to another category.
CVE-2026-20340: Cisco Secure FMC Software Deserialization Arbitrary Root Command Execution Vulnerability
Even a read-only Security Analyst account can submit an FMC web-management payload that executes as root. Review those accounts and install the CVE-specific fixed release; a read-only application role does not remove this execution risk.
CVE-2026-20341: Cisco Secure FMC Software sftunnel Deserialization Root Command Execution Vulnerability
Privileged access on a managed FTD device can enable sftunnel deserialization attacks against FMC and its high-availability peer. Review managed-device trust and apply the specific fix, retaining Cisco's differing descriptions of the required privilege.
CVE-2026-20247: Cisco ISE Unauthenticated SQL Injection Vulnerability
Unauthenticated SQL injection can modify Cisco ISE database contents. Apply the CVE-specific patch and investigate earlier data changes separately; the reviewed impact does not establish database disclosure or operating-system control.
CVE-2026-20309: Cisco Identity Services Engine Cross-Site Scripting Vulnerability
An attacker can lure an ISE management user into clicking a crafted link that runs script in the trusted interface. Apply the CVE-specific patch; user interaction is required for this reflected cross-site scripting path.
CVE-2026-20248: Cisco Secure Firewall ASA and FTD TCP DNS Denial of Service Vulnerability
A crafted DNS-over-TCP reply can reload vulnerable ASA or FTD devices. Assess the answering DNS service and response path, then install fixed software; the attacker must control or alter the device's DNS exchange.