Vulnerabilities
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Vulnerability Overview
Cisco Identity Services Engine (ISE) is a key component for network access control. A recent advisory reveals that the web‑based management interface fails to validate user input properly, creating a reflected cross‑site scripting (XSS) flaw. An attacker who can lure a legitimate user to click a crafted link could inject JavaScript that executes within the context of the ISE console.
Impact
- Execution of arbitrary scripts in the victim’s browser session.
- Potential theft of session cookies or sensitive data displayed by the console.
- Privilege escalation if the victim is an administrator.
Mitigation
Cisco has issued software updates that patch the issue. System administrators should apply the latest ISE release as soon as possible. No interim workarounds are available.
Key Details
- Severity: Medium
- CVEs: CVE‑2026‑20309
- Affected product: Cisco Identity Services Engine (web interface)
"The vulnerability exists because the web-based management interface does not properly validate user-supplied input."
For a full list of related advisories, see Cisco’s Advance Notification for Publication of September 16, 2026, Security Advisories.
Related vulnerabilities
Cisco IMC Web Interface XSS Exploit Enables Remote Script Execution – CVE‑2026‑20198
A newly disclosed cross‑site scripting flaw in Cisco’s Integrated Management Controller (IMC) web UI allows an authenticated, remote attacker to inject malicious code into a victim’s browser. By luring a logged‑in user to click a crafted link, the attacker can execute arbitrary scripts or steal browser‑based data. Cisco has released patches; no work‑arounds are available. The vulnerability carries a Medium impact rating and is tracked as CVE‑2026‑20198.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Schneider Electric SCADAPack x70 RTU Vulnerability (CVE‑2026‑81861) – Urgent RBAC Migration Needed
Schneider Electric’s SCADAPack x70 series – including the 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 models – is affected by CVE‑2026‑81861. The flaw stems from insufficiently protected credentials that allow attackers to hijack the Secure Lock feature and gain unauthorized access to RTU configuration. The vulnerability carries a CVSS score of 6.5 and threatens critical manufacturing and energy infrastructures worldwide. Immediate remediation requires disabling legacy Secure Lock, enabling Role‑Based Access Control (RBAC), and applying standard hardening measures such as network segmentation and
Read briefing