Vulnerabilities
Cisco Finesse Remote File Inclusion Vulnerability (CVE‑2026‑20175) – Unauthenticated Browser Exploit
Cisco Finesse now contains a remote file inclusion flaw that lets attackers inject arbitrary files into a user’s session via crafted HTTP requests. The weakness arises from insufficient input validation, allowing unauthenticated, remote attackers to load malicious scripts into the browser and steal data. Cisco has released patches; no workarounds are available, so affected systems must be updated immediately.
What the Flaw Does
Cisco Finesse can accept HTTP requests that reference external files. Because the input is not properly validated, an attacker can supply a URL pointing to a malicious script. When an end‑user clicks a crafted link, the script is loaded into the active session, executing in the victim’s browser context.
How Attackers Exploit It
An attacker who knows the device’s address can lure a user into clicking a link that contains that address and a reference to the malicious file. No authentication is required, and the payload runs with the privileges of the affected interface.
Impact
Successful exploitation can lead to:
- Browser‑based attacks such as cross‑site scripting or session hijacking
- Execution of arbitrary code on the device
- Unauthorized access to sensitive information stored on the Finesse appliance
Mitigation
Cisco has issued software updates that fix the validation flaw. There are no interim workarounds. All affected installations should apply the latest patch as soon as possible.
CVE-2026-20175
Related vulnerabilities
Cisco IMC Web Interface XSS Exploit Enables Remote Script Execution – CVE‑2026‑20198
A newly disclosed cross‑site scripting flaw in Cisco’s Integrated Management Controller (IMC) web UI allows an authenticated, remote attacker to inject malicious code into a victim’s browser. By luring a logged‑in user to click a crafted link, the attacker can execute arbitrary scripts or steal browser‑based data. Cisco has released patches; no work‑arounds are available. The vulnerability carries a Medium impact rating and is tracked as CVE‑2026‑20198.
Read briefing
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing