Cisco has released crucial updates to address a multitude of serious vulnerabilities identified in its Secure Firewall Management Center (FMC), Identity Services Engine (ISE), and Nexus Dashboard. These updates were made public on Wednesday and are critical for maintaining the security of affected systems.
Significant Security Updates for ISE
The ISE security patch is particularly notable, addressing 20 Common Vulnerabilities and Exposures (CVEs), with 12 classified as critical. Cisco has highlighted that three of these issues had already been disclosed publicly before the patch release.
The vulnerabilities, namely CVE-2026-20282, CVE-2026-20283, and CVE-2026-20284, pose significant risks as they allow remote attackers to perform actions such as SQL injection, data tampering, and arbitrary command execution. These exploits require administrative access to be leveraged.
While CVE-2026-20282 and CVE-2026-20283 are considered medium-severity, Cisco warns that they can potentially lead to root access, making them high-risk. CVE-2026-20284 is a critical flaw due to insufficient validation of user input, which could result in data alteration and denial-of-service attacks.
Comprehensive Fixes for FMC
Cisco’s FMC updates address 18 CVEs, with eight marked as critical. These vulnerabilities could enable attackers to execute arbitrary commands, escalate privileges to root, and bypass system protections.
A standout in this update is CVE-2026-20332, which is linked to vulnerabilities previously exploited in the wild, such as CVE-2026-20079 and CVE-2026-20316. These were identified earlier in the year and have been actively targeted since August.
Nexus Dashboard and Additional Threats
The Nexus Dashboard was also subject to critical patches, addressing six severe CVEs. These vulnerabilities span authentication issues, code and command injection, cleartext storage, and path traversal, among others.
Cisco has also issued warnings regarding an authentication bypass vulnerability in ISE that has already seen exploitation as a zero-day attack. Users are urged to apply these updates swiftly to mitigate potential risks.
For more detailed information, Cisco’s security advisories provide comprehensive insights and guidance on these vulnerabilities and their resolutions. The updates underscore the ongoing need for vigilance in cybersecurity practices.
