Advisories
Cisco BroadWorks CommPilot: Auth Bypass Lets Low‑Privilege Users Flip Configs
Cisco has disclosed a medium‑impact vulnerability in its BroadWorks CommPilot web‑management interface that allows authenticated users with minimal privileges to modify device configurations by sending crafted HTTP requests. The flaw stems from missing authorization checks and can be exploited remotely. Cisco has released patches; no workarounds exist.
What’s at stake?
The flaw lets an attacker, once authenticated, change settings on the BroadWorks CommPilot application. It bypasses the normal permission checks, so even low‑level users can push configuration changes that affect call routing, user access, and more.
How it works
By crafting a specific HTTP request to the web‑based management console, an attacker can trick the system into treating the request as coming from a higher‑privilege account. The missing authorization check on several configuration pages is the root cause.
Impact & Mitigation
Once exploited, the attacker can alter any configuration page the application exposes, potentially disrupting service or creating backdoors. Cisco has issued software updates that patch the issue. No interim workaround is available.
Patch status
- CVE‑2026‑76438
- Security Impact: Medium
- Apply the latest CommPilot firmware or software bundle released by Cisco.
“If you’re running BroadWorks CommPilot, update immediately. The vulnerability is easy to exploit and can have serious operational consequences.”
Related vulnerabilities
Cisco BroadWorks XML Parser Vulnerability (CVE‑2026‑20320) Enables Remote File Disclosure
A flaw in Cisco BroadWorks’ Open Client Interface XML parser lets unauthenticated attackers send crafted messages to the OCI‑P service and retrieve sensitive configuration files. The issue stems from default external entity resolution, enabling a blind XML External Entity (XXE) injection. Cisco has issued patches; no work‑arounds exist. Systems running BroadWorks should apply the update immediately.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Cisco Contact Center SSRF Vulnerability (CVE‑2026‑20314) Requires Authenticated Access
Cisco’s Packaged and Unified Contact Center Enterprise (CCE) software contains a server‑side request forgery flaw that can be leveraged by anyone who has valid credentials on the system. The defect arises from lax validation of HTTP requests, allowing attackers to instruct the affected device to issue arbitrary outbound traffic. Cisco has released patches to fix the issue; no workarounds are available. Organizations running CCE must apply the update immediately to stop potential internal network reconnaissance and data exfiltration.
Read briefing