These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-20171 is a Cisco-reported BGP denial-of-service issue affecting Nexus 3000 Series and Nexus 9000 Series Switches in standalone NX-OS mode. A remote attacker who can get a crafted BGP update delivered through an established peer session may cause incorrect parsing of a transitive BGP attribute, leading the device to drop the BGP session and flap with the forwarding peer. The practical impact is di [truncated]
CVE-2026-20210 is a medium-severity vulnerability in Cisco Catalyst SD-WAN Manager that allows authenticated, remote attackers with read-only permissions to modify configurations and perform unauthorized actions. This vulnerability exists due to a failure to redact sensitive information within device configurations and templates. An attacker could exploit this vulnerability by elevating their read-only pe [truncated]
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and perform actions as a high-privileged user. This vulnerability exists because sensitive session information is recorded in audit logs. An attacker could exploit this vulnerability by elevating their [truncated]
CVE-2026-20182 is a Cisco Catalyst SD-WAN Controller authentication bypass vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2026-05-14. Because it is on the KEV list, defenders should treat it as a priority exposure and follow CISA’s ED-26-03 and Cisco SD-WAN hunt-and-hardening guidance without delay. CISA’s metadata also notes that, where mitigations are not available, orga [truncated]
A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive information on an affected device. This vulnerability is due to improper role-based access control (RBAC) permissions on the RADIUS Policy API endpoints. An attacker could exploit this vulnerability by bypassing the w [truncated]
A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary log files from the server. This vulnerability is due to insufficient authorization checks on the download service API. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow [truncated]
CVE-2026-20169 is a vulnerability in the web-based management interface of Cisco IoT Field Network Director. An authenticated, remote attacker with low privileges could access files and execute commands on a remote router. This vulnerability is due to insufficient input validation of user-supplied data. An attacker could exploit this vulnerability by submitting crafted input in the web-based management in [truncated]
CVE-2026-20167 is a high-severity vulnerability in the web-based management interface of Cisco IoT Field Network Director. An authenticated, remote attacker with low privileges can exploit improper error handling to cause a DoS condition on a remotely managed router. The vulnerability is due to improper error handling, allowing an attacker to submit crafted input and request unauthorized files from a remo [truncated]
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arb [truncated]
CVE-2026-20133 is a Cisco Catalyst SD-WAN Manager vulnerability that CISA has added to its Known Exploited Vulnerabilities catalog. The supplied source material indicates the issue involves exposure of sensitive information to an unauthorized actor and directs defenders to Cisco and CISA mitigation guidance. Because CISA assigned a near-term remediation deadline, this should be treated as an urgent exposu [truncated]
CVE-2026-20128 is a Cisco Catalyst SD-WAN Manager vulnerability involving passwords stored in a recoverable format. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-20 and set a remediation due date of 2026-04-23, so it should be treated as urgent. The supplied record does not include a CVSS score, so operational priority should be driven by the KEV listing and the potential exposur [truncated]
CVE-2026-20122 is a Cisco Catalyst SD-WAN Manager vulnerability described as an incorrect use of privileged APIs. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-20 and set a remediation due date of 2026-04-23, which means defenders should treat it as urgent.
CVE-2026-20186 is a critical vulnerability in Cisco Identity Services Engine (ISE) that allows authenticated remote attackers to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit [truncated]
A critical vulnerability was found in Cisco Identity Services Engine (ISE), allowing authenticated remote attackers to execute arbitrary commands on the underlying operating system with Read Only Admin credentials. The vulnerability is due to insufficient input validation. Successful exploitation could lead to user-level access and potential privilege escalation to root. This could also cause a denial of [truncated]
A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability existed because HTML and script content was not properly handled. Prior to being addressed, an attacker could have exploited this by persuading a user to follow a malicious link, potentially stealing sensitive br [truncated]
A critical vulnerability in Cisco ISE and Cisco ISE-PIC allows authenticated remote attackers to execute arbitrary commands on the underlying operating system. To exploit this, attackers need valid administrative credentials. This vulnerability results from insufficient validation of user-supplied input. Successful exploitation could allow attackers to gain user-level access and elevate privileges to root [truncated]
CVE-2026-20132 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). An authenticated, remote attacker with administrative write privileges could exploit this vulnerability to conduct a stored XSS attack or a reflected XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due [truncated]
CVE-2026-20160 is a critical vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) that allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root-level privileges. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of th [truncated]
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access. This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying t [truncated]
CVE-2026-20151 is a HIGH-severity vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) that allows authenticated, remote attackers to elevate privileges from low to administrative. The vulnerability is due to improper transmission of sensitive user information. Exploitation requires valid credentials for a user account with at least the role of System User and interaction with the web interface.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-01T17:28:30.733Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability, CVE-2026-20097, affects the Cisco Unified Computing System, specifically within the web-based management interface of Cisco IMC, allowing authenticated admin users to execute arbitrary cod [truncated]
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-base [truncated]
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exp [truncated]
A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attac [truncated]
CVE-2026-20042 is a MEDIUM severity vulnerability in the configuration backup feature of Cisco Nexus Dashboard. An attacker with the encryption password and access to Full or Config-only backup files could access sensitive information, execute arbitrary commands as the root user. This vulnerability exists because authentication details are included in the encrypted backup files. A successful exploit could [truncated]
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface t [truncated]
CVE-2026-20012 is a high-severity vulnerability in Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software. The vulnerability is due to improper parsing of IKEv2 packets, which could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition [truncated]
CVE-2026-20131 is a Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management deserialization of untrusted data vulnerability. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-19 and marked known ransomware campaign use, with a remediation due date of 2026-03-22. Treat this as an active exposure requiring immediate defensive review of a [truncated]
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this [truncated]
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affecte [truncated]