Cisco
CVE-2026-76434: Cisco ISE Arbitrary File Read Vulnerability
An ISE or ISE-PIC administrator can read arbitrary files through certificate import. Install the CVE-specific update and assess earlier import requests; the description supports file disclosure, not command execution from importing a certificate.
CVE-2026-76438: Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability
A low-privilege BroadWorks CommPilot user can change configuration on selected pages through missing authorization checks. Choose the fix for the installed CommPilot or bundled Application Server package; authentication is still required.
CVE-2026-76439: Cisco ISE Event Injection Vulnerability
Unauthenticated guest-portal requests can forge ISE endpoint posture-status events. Apply the specific update and preserve posture history; the reviewed description establishes status manipulation, not operating-system command execution despite the inconsistent heading.
CVE-2026-76444: Cisco ISE Information Disclosure Vulnerability
Missing authentication on the ISE and ISE-PIC PRRT service can expose sensitive configuration. Check that internal service's reachability and install the CVE-specific fix; the stated impact is disclosure, not administrative configuration changes.
CVE-2026-76446: Cisco ISE External Entity Injection Vulnerability
A privileged authenticated request can use XML external entities to read files through an ISE or ISE-PIC API. Apply the specific fix; accessible files remain constrained by the underlying process's permissions.
CVE-2026-76447: Cisco ISE Certificate Reload Vulnerability
Unauthenticated requests can force the ISE or ISE-PIC OCSP responder to reload certificate and key material. Update and review unexpected reloads; this is an availability concern, not established private-key theft or certificate replacement.
CVE-2026-76448: Cisco Identity Services Engine SQL Injection Vulnerability
Cisco ISE and ISE-PIC database injection requires administrative credentials. Follow this advisory's own patch or migration mapping, including ISE-PIC's 3.4 support limit, rather than borrowing fixes or impacts from neighboring vulnerabilities.
CVE-2026-76449: Cisco Identity Services Engine SQL Injection Vulnerability
Cisco's authenticated database-injection entry covers ISE and ISE-PIC without identifying this CVE's exact query endpoint. Match product and branch to the fixed patch; the ISE 3.5 target is not an ISE-PIC upgrade path.
CVE-2026-76450: Cisco Identity Services Engine SQL Injection Vulnerability
This authenticated database-injection flaw affects ISE, not ISE-PIC. Match the ISE patch guidance and review administrative API access; the shared advisory does not identify this CVE's exact query or establish operating-system command execution.
CVE-2026-20336: Cisco ASA, FTD, and FMC hardening: Resource Lifetime Management Vulnerabilities
Cisco groups resource-lifetime flaws across ASA, FTD and FMC without describing an individual attack path. The article separates conflicting source scores and affected-hotfix guidance from an exploitation footnote belonging to another category.