Vulnerabilities
Cisco Releases Patches for 35 Vulnerabilities, Including 12 Critical Bugs
Cisco issued updates for 35 security flaws across its product line, 12 of which are critical. The patches address memory corruption, authentication bypass, and DoS vulnerabilities that could allow unauthorized access, privilege escalation, and remote code execution. Defenders should update affected devices immediately and verify patch deployment.
What Happened
Cisco announced on Wednesday a comprehensive patch set covering 35 vulnerabilities across its portfolio, with 12 bugs rated critical. The update includes fixes for memory corruption, authentication bypass, and denial‑of‑service conditions that could be exploited without authentication.
Impact
Exploit vectors include buffer overflows (CVE-2026-76464), unauthorized access (CVE-2026-20328), DoS (CVE-2026-76454), missing authentication (CVE-2026-76482), improper cryptographic verification (CVE-2026-76480), and credential exposure (CVE-2026-76483). Successful exploitation could lead to privilege escalation, remote code execution, and data leakage.
Affected Products
- Meraki firmware – seven CVEs grouped by weakness type.
- License On‑Prem – eight bugs, five critical, including CVE-2026-20328 and CVE-2026-76454.
- NX‑OS – fourteen vulnerabilities, seven critical, covering improper access control and out‑of‑bounds writes.
What to Do
1. Identify whether your environment runs Meraki, License On‑Prem, or NX‑OS and determine the affected version.
2. Download and apply the latest Cisco Security Advisory patches from the official Cisco website.
3. Verify patch installation via checksums or version strings.
4. Conduct a quick audit of authentication and privilege configurations to ensure no residual misconfigurations remain.
5. Monitor logs for anomalous activity that could indicate exploitation attempts.
Related vulnerabilities
OpenSSL and WolfSSL Patch High‑Severity DTLS Vulnerabilities (CVE‑2026‑84782, CVE‑2026‑84783)
OpenSSL and WolfSSL released updates fixing a dozen critical bugs, including CVE‑2026‑84782 that lets unauthenticated attackers leak heap fragments or crash DTLS sessions. The flaw can be triggered during a DTLS handshake and is exploitable over the network without credentials. Defenders should upgrade to the latest releases and verify DTLS configurations.
Read briefing
Microsoft Releases 570 Vulnerability Fixes, Including 3 Zero‑Days and 60 Critical Issues
Microsoft’s latest Patch Tuesday fixed 570 security flaws across Windows and related products, including three zero‑day vulnerabilities and 60 critical bugs that could allow remote control or privilege escalation. Defenders should apply updates immediately, verify affected components, and monitor for exploitation of the newly disclosed CVEs.
Read briefing
Google Issues Emergency Chrome Desktop Update Addressing 108 Security Flaws
Google has rolled out Chrome version 154 for desktop platforms, patching 108 security vulnerabilities, including 11 critical severity bugs. SecOps and system administrators should immediately enforce browser updates across all Windows, macOS, and Linux endpoints. Concurrently, an early stable rollout of Chrome 155 is underway for Android devices.
Read briefing
Cisco FMC Java Deserialization Flaw Lets Remote Attacker Gain Root
Cisco’s Secure Firewall Management Center (FMC) suffers a critical insecure Java deserialization bug that permits unauthenticated remote actors to execute arbitrary code as root. By sending a crafted Java byte stream to a specific TCP port from a host listed in the external database access list, an attacker can elevate privileges and run any command. No workaround exists; Cisco has released patches for the affected releases. The flaw is catalogued as CVE‑2026‑20242 and rated Critical.
Read briefing