CVE-2026-76418

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Listed

Vendors

Cisco

Products

Adaptive Security Appliance Software Cisco Secure Firewall Threat Defense (ftd) Software Secure Firewall Threat Defense

CVE-2026-20293

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin&nbsp;or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software. This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Unified Computing System E-series Software Enterprise Nfv Infrastructure Software Unified Computing System and 2 more

CVE-2026-20011

Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed. An attacker could exploit this vulnerability by sending crafted SMTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-76445

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-76466

Cisco Expressway Series Remote Code Execution Vulnerability

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Expressway Series

CVE-2026-76462

Cisco Secure Client Privilege Escalation Vulnerability

A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a series of crafted IPC messages to a local socket. A successful exploit could allow the attacker to perform limited file write operations on the filesystem with SYSTEM or root privileges. Although this vulnerability affects the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux operating systems, this vulnerability could be used to obtain full root privileges on macOS and Linux. For that reason Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Secure Client

CVE-2026-20218

Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability

A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;&nbsp; This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-20221

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities

Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 3 more

CVE-2026-20179

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities

Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when Snort 3 parses GRE packets. An attacker could exploit this vulnerability by sending a crafted GRE packet to a targeted device to be parsed by Snort. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-76524

Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability

A vulnerability in the control channel socket implementation of&nbsp;Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3

CVE-2026-76505

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp; This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic. The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Ios Xr Software

CVE-2026-76489

Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory. An attacker could exploit this vulnerability by sending a large number of files to be processed. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Secure Firewall Threat Defense

CVE-2026-76487

Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Unified Communications Manager

CVE-2026-76435

Cisco Expressway Series Information Disclosure Vulnerability

A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Expressway Series

CVE-2026-20197

Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability

Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when Snort 3 parses Teredo packets. An attacker could exploit this vulnerability by sending a crafted Teredo packet to a targeted device to be parsed by Snort. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-20019

Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities

Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when Snort 3 parses UDP Netflow Protocol packets. An attacker could exploit this vulnerability by sending a single crafted Netflow packet through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cisco Open Source Snort3 Cisco Secure Firewall Threat Defense (ftd) Software Cisco Utd Snort Ips Engine Software and 1 more

CVE-2026-76519

Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with&nbsp;root privileges on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS 6.2% KEV · Listed

Vendors

Cisco

Products

Asyncos Secure Email Secure Email Gateway C195 and 5 more

CVE-2026-76438

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request.&nbsp;A successful exploit could allow the attacker to alter configurations on select pages.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Broadworks

CVE-2026-20321

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Application Policy Infrastructure Controller (apic)

CVE-2026-20032

Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected&nbsp;device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Nx-os Software