Cisco
CompanyVulnerabilities
1 CVE in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-76418 Exploited added to KEV 29 Oct
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Zero-day reported by Canadian Centre for Cyber SecurityCisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
- Zero-day reported by watchTowr LabsCISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw
- Zero-day reported by The Hacker NewsVolt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
- Vulnerability reported by Horizon3.aiSSRF flaws reported in Fortinet FortiSIEM GUI and Cisco Finesse management interface
Recent news
Cisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
Cisco has patched CVE-2026-76418, a high-severity flaw (CVSS 8.6) in the remote access SSL VPN of Secure Firewall ASA and Threat Defense (FTD). An unauthenticated remote attacker can send a crafted request that forces a device reload, causing denial of service. The flaw is being exploited in the wild and has been added to CISA's KEV catalogue, with federal agencies required to remediate by 1 November 2026. Cisco urges immediate updating and offers a temporary mitigation of disabling secondary authentication on the tunnel group list or DefaultWEBVPNGroup.
CISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw
CISA added VMware ESX CVE-2026-41709 (insufficient logging, CVSS 7.6) and Linux kernel CVE-2026-46300 (Fragnesia) to its KEV catalogue. CrowdStrike reports that Warp Panda exploited the ESX flaw as a zero-day in early 2026 to reduce audit log visibility. The Cyber Centre also flagged exploitation of a Siemens Software Center DLL sideloading flaw and Gitea vulnerabilities, and urged administrators to apply updates.
Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Lumen's Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus group Volt Typhoon. It was first identified in late 2023 and was used for zero-day exploitation and strategic access, using rotating chains of compromised SOHO, IoT and enterprise devices. Cisco Talos linked malware that steals keys from Cisco SD-WAN to infrastructure overlapping with this network, which has since been disrupted.
SSRF flaws reported in Fortinet FortiSIEM GUI and Cisco Finesse management interface
Fortinet has published an advisory for a server-side request forgery flaw in the FortiSIEM GUI, scored CVSSv3 3.8, which lets an authenticated attacker send crafted HTTP requests that originate from the device. Separately, CVE-2026-20362 affects the web-based management interface of Cisco Finesse, where an unauthenticated remote attacker can use crafted HTTP requests to obtain limited sensitive information from associated services (CVSS v3.1 7.2, High). The Cisco issue was found by Horizon3 researchers.