Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| None | n/a | cisco-sa-emudhra-info-ScS22A1r |
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
CiscoCisco IOS XR Software, Cisco Secure Firepower Management Center (FMC) Software, Cisco ThousandEyes Enterprise Agent, Cisco Duo Access Gateway, Cisco Duo Agentic Authorization Connector, Cisco Duo Network Gateway, Cisco Meraki Dashboard, Cisco Meraki MV Smart Camera Firmware, Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure
|
Cisco PSIRT | |||
|
cisco-sa-emudhra-info-ScS22A1rCisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Executive summaryCisco says eight intermediate certificates from the certificate authority eMudhra have weak private keys that can be brute-forced within seconds, so attackers could issue fraudulent TLS and code signing certificates. Cisco is still investigating its product line, and the advisory names a limited set of Cisco products as impacted, with some fixes or cloud remediation under way. Cisco recommends reviewing the vulnerable products table and applying the listed upgrades or remediation steps. Technical summaryThe flaw is a cryptographic key weakness: the private keys for eight eMudhra intermediate certificates were broken by an error in their April 2025 Key Generation Ceremony, so anyone can brute-force them, and the eight certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025. The advisory says the issue lets holders of these keys issue fraudulent TLS certificates for any domain and sign malicious code, and it states that a public announcement exists but that Cisco PSIRT is not aware of malicious use. The advisory lists target release dates and upgrade versions for some products, including Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, IOS XR Software 26.4.1 (target Nov 30, 2026), and Ultra Cloud Core - Subscriber Microservices Infrastructure 2026.04.1 (Nov 2026), but it does not give fixed versions for every product. The header states no workarounds are available, and the advisory says any workarounds will be documented in the Vulnerable Products section. Secure Firepower Management Center has a Cisco TechZone article for configuring a TLS policy to block known eMudhra certificate issuers. Detection guidance beyond that is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…mudhra-info-ScS22A1r ScoreNo CVSS score published. AffectsCiscoCisco IOS XR SoftwareCisco Secure Firepower Management Center (FMC) SoftwareCisco ThousandEyes Enterprise AgentCisco Duo Access GatewayCisco Duo Agentic Authorization ConnectorCisco Duo Network GatewayCisco Meraki DashboardCisco Meraki MV Smart Camera FirmwareCisco Ultra Cloud Core - Subscriber Microservices Infrastructure
Cisco Product Security Incident Response TeamPublished
Read the advisory
|
|||||||
| Critical | n/a | cisco-sa-php-october26-Jj384Daq |
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Cisco, PHPPHP, Cisco Duo Access Gateway, Cisco Ultra-Reliable Wireless Backhaul (URWB), Cisco Expressway Series, Cisco Expressway Select Series
|
Cisco PSIRT | |||
|
cisco-sa-php-october26-Jj384DaqCVE-2026-109618CVE-2026-109619Vulnerabilities in PHP Affecting Cisco Products: October 2026
Executive summaryCisco published an advisory covering two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution. The advisory names a small set of Cisco products as affected, including Ultra-Reliable Wireless Backhaul, Expressway, and Duo Access Gateway, while many other Cisco products are listed as not affected or still under investigation. Cisco recommends applying the fixed software releases in the associated bug IDs and notes that workarounds exist for some products. Technical summaryThe flaws are remote code execution issues in PHP: CVE-2026-109618 is described as RCE via OOM corruption and CVE-2026-109619 as RCE via stale global state. The advisory does not state the network attack vector or other exploit preconditions for the core PHP flaws, but the Duo Access Gateway footnote says the attacker must be authenticated as an administrator for that product, with a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H and a score of 6.6. Affected and fixed releases listed are Ultra-Reliable Wireless Backhaul (URWB) with fixed release 27.1.1 (Feb 2027) under bug CSCwx37073, Expressway Series and Expressway Select Series with fixed release 15.5.21 (TBD) under bug CSCwx37062, and Duo Access Gateway with fixed release 3.2.0. A workaround is stated for URWB, with details in its bug ID, and workarounds for other products are referenced to bug IDs. The advisory lists Snort rules 67359 and 67360 as action links, but it does not give further detection guidance. Cisco states it is aware of a public announcement but not of any malicious use, and it does not state a base CVSS score for the core PHP flaws. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…p-october26-Jj384Daq ScoreNo CVSS score published. AffectsCiscoPHPPHPCisco Duo Access GatewayCisco Ultra-Reliable Wireless Backhaul (URWB)Cisco Expressway SeriesCisco Expressway Select Series
Cisco Product Security Incident Response TeamPublished
Read the advisory
|
|||||||