LIVE INTELLIGENCE

The Wire

Verified technology, security, and framework changes — structured for the people responsible for keeping systems running.

UPDATED CONTINUOUSLY

28 VERIFIED SHIFTS

SW-000230CISCO · CISCO LICENSE ON-PREM (FORMERLY SMART SOFTWARE MANAGER ON-PREM) · CISCO LICENSE ON-PREMCRITICALACTION REQUIRED6H AGO

Cisco patches multiple internally-found critical flaws in License On-Prem (SSM On-Prem)

Cisco's internal security review of Cisco License On-Prem (formerly Smart Software Manager On-Prem) identified several vulnerability classes, grouped into four CVEs covering missing authentication, improper cryptographic signature verification, insufficiently protected credentials, and code injection. The highest CVSS score reaches 10.0. Cisco has released fixed software; no workarounds exist. No public exploitation is known; issues were found via internal testing, including use of frontier AI models.

SECURITY · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000231CISCO · MERAKI · MERAKI CAMPUS GATEWAYS, MG, MR, MS, MV, MX DEVICESCRITICALACTION REQUIRED6H AGO

Cisco Meraki Security Hardening Release Fixes Critical Internally Found Vulnerabilities

Cisco published a security hardening advisory for its Meraki product line covering Campus Gateways, MG Cellular Gateways, MR Wireless APs, MS Switches, MV Smart Cameras, and MX Security/SD-WAN appliances. The vulnerabilities were discovered internally (not actively exploited) and grouped by CWE class, each assigned a CVE ID with CVSS scores up to 9.6. Cisco has released fixed software for each affected product line; no workarounds exist.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000232CISCO · APPLICATION POLICY INFRASTRUCTURE CONTROLLER (APIC)CRITICALACTION REQUIRED6H AGO

Cisco discloses three critical APIC vulnerabilities via internal hardening release (CVSS 9.8)

Cisco published a security advisory covering three CVEs (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500) affecting the Application Policy Infrastructure Controller (APIC), discovered internally during proactive security testing. The highest CVSS base score is 9.8. No workarounds exist; Cisco has released fixed software. There is no evidence of public exploitation.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000238CISCO · NX-OS SOFTWARE · MDS 9000 SERIES, NEXUS 3000/7000/9000 SERIES, UCS 6300/6400/6500/6600 SERIES AND UCS X-SERIES FABRIC INTERCONNECTSCRITICALACTION REQUIRED6H AGO

Cisco discloses six internally found NX-OS vulnerabilities, max CVSS 9.8, fixes available

Cisco's internal security review of NX-OS Software identified six vulnerabilities (CVE-2026-76453, -76455 through -76459) spanning improper neutralization, improper access control, improper input validation, out-of-bounds read, improper exception handling, and out-of-bounds write (CWE-707, CWE-20, CWE-284, CWE-125, CWE-703, CWE-787). The highest CVSS base score is 9.8. These were discovered during internal testing (including use of frontier AI models) and are not known to be publicly announced or exploited. No workarounds exist; Cisco has released fixed software for affected platforms.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000244AWS · AWS OPS WHEELCRITICALACTION REQUIRED6H AGO

AWS Ops Wheel v2 flaws allow unauthenticated admin access (CVE-2026-6911, CVE-2026-6912)

AWS published a security bulletin for AWS Ops Wheel, an open-source CloudFormation-deployed tool, describing two vulnerabilities in its v2 deployment: a missing JWT signature verification flaw and an overly permissive Cognito attribute write configuration. Both were fixed in subsequent pull requests, and AWS recommends redeploying from the latest version.

SECURITY · IDENTITY · CLOUD · VULNERABILITY · SECURITY ADVISORYSOURCE AMAZON WEB SERVICES, INC.VIEW SHIFT

SW-000216CISCO · NX-OS SOFTWARE · NEXUS 3000 AND 9000 SERIES SWITCHESCRITICALACTION REQUIRED3D AGO

Critical RCE flaw in MPLS OAM on Cisco Nexus 3000/9000 NX-OS switches (CVE-2026-76465)

Cisco disclosed a critical vulnerability (CVSS 9.8) in the MPLS OAM feature of NX-OS Software affecting Nexus 3000 Series Switches and Nexus 9000 Series Switches in standalone NX-OS mode. An unauthenticated remote attacker can send a crafted MPLS echo-request to execute arbitrary code with root privileges or cause a denial of service. No workarounds exist; Cisco has released fixed software and a temporary Live Protect shield mitigation.

NETWORK · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000203CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) AND ISE PASSIVE IDENTITY CONNECTOR (ISE-PIC)CRITICALACTION REQUIRED3D AGO

Cisco patches critical RCE and high-severity info-disclosure flaws in ISE/ISE-PIC

Cisco disclosed two independent vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): CVE-2026-20181, a critical (CVSS 9.1) authenticated remote code execution flaw allowing privilege escalation to root, and CVE-2026-20190, a high-severity (CVSS 7.5) unauthenticated information disclosure flaw exposing sensitive data including hashed credentials. No workarounds exist; Cisco has released fixed software for both issues.

SECURITY · IDENTITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000207CISCO · CISCO UNIFIED COMMUNICATIONS MANAGER (UNIFIED CM) AND UNIFIED CM SESSION MANAGEMENT EDITION (UNIFIED CM SME)CRITICALACTION REQUIRED3D AGO

Cisco Unified CM SSRF flaw (CVE-2026-20230) under active exploitation, rated Critical

Cisco disclosed a server-side request forgery vulnerability in Unified Communications Manager and Unified CM SME caused by improper input validation of HTTP requests when the WebDialer service is enabled. An unauthenticated remote attacker could exploit it to write files to the underlying OS, potentially escalating to root. Cisco has confirmed active exploitation in the wild as of June 2026 and released fixed software; no workarounds exist, though disabling WebDialer mitigates risk.

COLLABORATION · SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000208GRID PROTECTION ALLIANCE · INDUSTRIAL CONTROL SYSTEMS · OPENPDC AND OPENHISTORIANCRITICALACTION REQUIRED3D AGO

CISA Details Six Vulnerabilities in GPA openPDC and openHistorian, Up to CVSS 9.8

CISA published ICS advisory ICSA-26-281-02 on October 8, 2026 describing six vulnerabilities (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) affecting Grid Protection Alliance's openPDC (<2.9.477 and <2.9.482, including the Docker image) and openHistorian (<2.8.580 and <2.8.585). Issues include unauthenticated/deserialization-based remote code execution, unauthenticated data publisher interfaces, SSRF via a Modbus connection feature, and a hard-coded administrative credential in the Docker image. GPA has released patched versions for openPDC and openHistorian and changed default network bindings; no fix is planned for the Docker image.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000213CISCO · CISCO LICENSE ON-PREM (FORMERLY SMART SOFTWARE MANAGER ON-PREM) · CISCO LICENSE ON-PREMCRITICALACTION REQUIRED3D AGO

Cisco patches critical arbitrary password reset flaw in License On-Prem (CVE-2026-20328, CVSS 9.1)

Cisco disclosed four vulnerabilities in Cisco License On-Prem (formerly SSM On-Prem) affecting the web-based management interface and API endpoints. The most severe, CVE-2026-20328, allows an unauthenticated remote attacker to reset the password of any account, including administrators, granting full unauthorized access. A second critical flaw, CVE-2026-76454, allows an unauthenticated attacker to write arbitrary files or cause denial of service via the Smart Licensing Utility API. Two medium-severity flaws (CVE-2026-76437 command injection, CVE-2026-76452 SQL injection) require existing administrative credentials to exploit. No workarounds exist; Cisco has released fixed software. Cisco Smart Licensing Utility is confirmed not affected.

SECURITY · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CISCOVIEW SHIFT

SW-000215CISCO · NX-OS SOFTWARE · NEXUS 3000 SERIES SWITCHES, NEXUS 9000 SERIES SWITCHES (STANDALONE NX-OS MODE), UCS 6300 SERIES FABRIC INTERCONNECTSCRITICALACTION REQUIRED3D AGO

Cisco NX-OS NX-API flaw allows unauthenticated root RCE, CVSS 9.8

Cisco disclosed a critical vulnerability (CVE-2026-76471) in the NX-API feature of NX-OS Software affecting Nexus 3000, Nexus 9000 (standalone mode), and UCS 6300 Series Fabric Interconnects. Insufficient input validation of data sent to NX-API could let an unauthenticated remote attacker execute arbitrary code with root privileges or cause a denial of service. No workarounds exist; fixed software has been released. Cisco PSIRT is unaware of public exploitation.

NETWORK · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000126LWIP · LWIP TCP/IP STACK MQTT CLIENT APPLICATIONCRITICALACTION REQUIRED11D AGO

CISA advisory: critical out-of-bounds write in lwIP MQTT Client Application (CVE-2026-87121)

CISA published an ICS advisory for a critical out-of-bounds write vulnerability (CVE-2026-87121) affecting lwIP MQTT Client Application versions >=2.0.1 and <=2.2.1. Successful exploitation could allow an attacker to achieve full code execution on the affected device. CVSS v3.1 base score is 9.8 (Critical) and CVSS v4.0 score is 9.3 (Critical).

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000097CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) / ISE-PIC · CISCO IDENTITY SERVICES ENGINECRITICALACTION REQUIRED11D AGO

Cisco ISE API authentication bypass flaw (CVE-2026-76460) actively exploited, CVSS 10.0

Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-76460) in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), affecting all device configurations. Cisco PSIRT confirmed active exploitation in the wild. No workarounds exist, though an iACL-based mitigation is available. Fixed patch releases are available for ISE/ISE-PIC 3.1 through 3.5.

IDENTITY · SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000119CITRIX · NETSCALERCRITICALACTION REQUIRED14D AGO

CISA adds two actively exploited Citrix NetScaler CVEs to KEV Catalog

CISA added CVE-2026-88771 and CVE-2026-88772, both affecting Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The alert reiterates that under Binding Operational Directive (BOD) 26-04, FCEB agencies must prioritize remediation of KEV-listed vulnerabilities on internet-exposed assets, especially those enabling full post-exploitation control.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000118CITRIX · CITRIX NETSCALER ADC AND CITRIX NETSCALER GATEWAYCRITICALACTION REQUIRED14D AGO

CISA flags active exploitation of critical zero-days in Citrix NetScaler ADC and Gateway

CISA is amplifying Citrix's disclosure of eight new vulnerabilities (CVE-2026-88771 through CVE-2026-88778) affecting Citrix NetScaler ADC and NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, are critical zero-days that independently allow remote code execution and have been added to CISA's Known Exploited Vulnerabilities catalog based on confirmed active exploitation.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)VIEW SHIFT

SW-000087CISCO · CISCO IDENTITY SERVICES ENGINE (ISE) · CISCO ISECRITICALACTION REQUIRED20D AGO

Cisco ISE fixes three authenticated vulnerabilities including critical SQL injection flaw

Cisco disclosed three vulnerabilities in Cisco Identity Services Engine (ISE) affecting the SXP REST API, IPsec Open API, and general write access to the underlying OS. CVE-2026-20284 (SXP REST API SQL injection, CVSS 9.1) is rated Critical; CVE-2026-20283 (IPsec Open API command injection, CVSS 6.5) and CVE-2026-20282 (authenticated write vulnerability, CVSS 4.9) are both rated High Security Impact despite lower CVSS scores because privilege escalation to root is easy. All require authenticated administrative access to exploit. Fixed software releases are available; a workaround exists only for CVE-2026-20283. ISE Passive Identity Connector (ISE-PIC) is confirmed not affected. Cisco PSIRT is aware of a public announcement but no known malicious exploitation.

IDENTITY · SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000086HITACHI ENERGY · FACTS CONTROL PLATFORM (FCP)CRITICALACTION REQUIRED21D AGO

Hitachi Energy FCP with GWS component affected by five vulnerabilities, one CVSS 9.9

CISA republished a Hitachi Energy PSIRT advisory describing five vulnerabilities in FACTS Control Platform (FCP) versions deployed with the GWS component since 2020, including SVC Light, Series Capacitor, Static Var Compensator, and Hybrid Synchronous Condenser systems. Vulnerabilities include improper data query neutralization, path traversal, authentication bypass via session capture-replay, missing authentication for a network-exposed service, and open redirect. Deployments without GWS are not affected.

SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE CISAVIEW SHIFT

SW-000075APPLE · MACOS TAHOE · MACOS TAHOE 26.7CRITICALACTION REQUIRED23D AGO

Apple patches over 100 CVEs in macOS Tahoe 26.7 security update

Apple released macOS Tahoe 26.7 on September 14, 2026, fixing a large number of security vulnerabilities across kernel, file system, networking, graphics, and application frameworks. Many issues involve out-of-bounds reads/writes, use-after-free, race conditions, and privilege-escalation flaws that could allow attackers to execute arbitrary code, corrupt kernel memory, bypass Gatekeeper or sandbox protections, or access sensitive user data.

EFFECTIVE SEP 14, 2026SECURITY · ENDPOINT · NETWORK · DATA · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT

SW-000059CISCO · CISCO ASYNCOS SOFTWARE · CISCO SECURE EMAIL GATEWAYCRITICALACTION REQUIRED26D AGO

Cisco Secure Email Gateway SQL injection flaw enables root-level command execution

Cisco disclosed a critical vulnerability (CVE-2026-76461, CVSS 9.8) in the email parsing logic of AsyncOS for Cisco Secure Email Gateway (physical and virtual, any configuration). An unauthenticated remote attacker can send a crafted email containing malicious SQL statements to achieve arbitrary command execution with root privileges on the underlying OS. Cisco PSIRT confirmed active exploitation in the wild as of September 2026. No workarounds exist; fixed software releases are available.

EMAIL · SECURITY · VULNERABILITY · SECURITY ADVISORYSOURCE CISCOVIEW SHIFT

SW-000062ST ENGINEERING IDIRECT · IQ-SERIES TERMINALS (EVOLUTION IQ-SERIES, 3315-SERIES, 9-SERIES)CRITICALACTION REQUIRED26D AGO

CISA Update A adds two new vulnerabilities to iDirect iQ-Series terminal advisory

CISA's Update A to ICSA-26-183-01 expands the advisory for ST Engineering iDirect iQ-Series satellite terminals (Evolution, 3315-Series, 9-Series, firmware <=4.5.2.1) from two to four vulnerabilities. The new CVE-2026-38056 (local privilege escalation, CVSS v4 9.4 critical) and CVE-2026-38058 (exposure of password hashes) were added alongside the existing unauthenticated API disclosure (CVE-2026-38059) and CSRF-based reboot flaw (CVE-2026-38057). Vendor has released fixed firmware 4.5.3.0.

SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT

SW-000055VEEAM · VEEAM SERVICE PROVIDER CONSOLECRITICALACTION REQUIRED27D AGO

Veeam Service Provider Console 9.2.1 fixes critical RCE and account takeover flaws

Veeam disclosed two vulnerabilities in Veeam Service Provider Console: CVE-2026-32998, a critical remote code execution flaw (CVSS 9.4), and CVE-2026-64635, a medium-severity password reset link hijacking issue enabling account takeover (CVSS 5.3). Both are fixed in version 9.2.1.33875. All version 9 builds up to 9.2.0.33215 and all earlier builds (9.1, 9.0, 8) are affected.

SECURITY · BACKUP · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000051CLOUDFLARE · CLOUDFLARE WAF · CLOUDFLARE MANAGED RULESETCRITICALACTION REQUIRED27D AGO

Cloudflare adds emergency WAF rule for Adobe Commerce/Magento zero-day RCE CVE-2026-75650

Cloudflare released an emergency Managed Ruleset update to block exploitation of an actively exploited, unauthenticated remote code execution vulnerability (CVE-2026-75650, nicknamed 'StyleSmuggler') affecting Adobe Commerce and Magento Open Source. The new rule sets action to Block for detected exploit patterns.

EFFECTIVE SEP 10, 2026SECURITY · NETWORK · SECURITY ADVISORY · VULNERABILITY · FEATURE RELEASESOURCE CLOUDFLAREVIEW SHIFT

SW-000044VEEAM SOFTWARE · VEEAM ONECRITICALACTION REQUIRED1MO AGO

Veeam ONE 13.x has critical SMB auth coercion flaw, patched CVE-2026-65641

Veeam disclosed CVE-2026-65641, a critical vulnerability in Veeam ONE that allows an unauthenticated network attacker to coerce SMB authentication from the service account. It affects Veeam ONE 13.1.0.7034 and all earlier version 13 builds; version 12.x is not affected. Fixes are available in Veeam ONE 13.1 Patch 0 (build 13.1.0.7233) and Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159).

SECURITY · ENDPOINT · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000041VEEAM SOFTWARE · VEEAM ONECRITICALACTION REQUIRED1MO AGO

Veeam ONE 13.1 patches seven vulnerabilities including a critical unauthenticated RCE

Veeam published KB4892 disclosing seven CVEs affecting Veeam ONE versions 12.x and 13.x, ranging from a critical unauthenticated remote code execution flaw (CVSS 10.0) to medium-severity data exposure via shared report links. Fixes are delivered in Veeam ONE 13.1 (build 13.1.0.7034), Veeam ONE 13.0.2 Patch 1 (build 13.0.2.7159), and Veeam ONE 12.3 Patch 1 (build 12.3.0.7165), depending on the CVE and installed version.

SECURITY · BACKUP · SECURITY ADVISORY · VULNERABILITYSOURCE VEEAM SOFTWAREVIEW SHIFT

SW-000040APPLE · MACOS TAHOE · MACOS TAHOE 26.5CRITICALACTION REQUIRED1MO AGO

macOS Tahoe 26.5 patches numerous kernel, WebKit, and system component vulnerabilities

Apple's security update for macOS Tahoe 26.5, released May 11, 2026, addresses a large number of vulnerabilities across kernel, WebKit, networking, storage, and many other system components. Several issues could allow sandbox escapes, kernel memory disclosure, privilege escalation to root, Gatekeeper bypass, and denial-of-service conditions. Some entries were added or updated after initial publication (noted August 25, 2026).

EFFECTIVE MAY 11, 2026SECURITY · ENDPOINT · NETWORK · SECURITY ADVISORY · VULNERABILITYSOURCE APPLEVIEW SHIFT

SW-000036MICROSOFT · WINDOWS / MICROSOFT OFFICE · WINDOWS, WINDOWS SERVER, MICROSOFT OFFICE, MICROSOFT DEFENDERCRITICALACTION REQUIRED1MO AGO

Microsoft September 2026 Patch Tuesday fixes 972 CVEs, 2 exploited zero-days, 113 Critical bugs

Microsoft's September 2026 security release addresses 972 vulnerabilities, more than double August's count and a new Patch Tuesday record. It includes two zero-day vulnerabilities confirmed as actively exploited in the wild (Windows Update Stack and Windows ALPC elevation-of-privilege flaws), 113 Critical vulnerabilities, and 857 additional lower-severity CVEs. Critical RCE flaws affect core infrastructure services including Netlogon, DNS Server, DHCP Server, MSMQ, Services for NFS, SSTP VPN, Kerberos, Hyper-V, Remote Desktop, and numerous Office products (Outlook, Word, Excel, PowerPoint, Graphics Components). A separate proof-of-concept zero-day dubbed 'ShieldCrash' was publicly disclosed against Microsoft Defender, discussed separately from the Microsoft patch set.

EFFECTIVE SEP 8, 2026SECURITY · ENDPOINT · NETWORK · IDENTITY · SECURITY ADVISORY · VULNERABILITYSOURCE CROWDSTRIKEVIEW SHIFT

SW-000028SOPHOS · MACOS · SOPHOS ENDPOINT (INTERCEPT X ENDPOINT FOR MACOS; SOPHOS HOME FOR MACOS)CRITICAL1MO AGO

Sophos patches critical macOS Endpoint LPE flaw CVE-2026-18367

Sophos disclosed and fixed a local privilege escalation vulnerability affecting Sophos Endpoint products for macOS, reported via its bug bounty program by an external researcher. The flaw allowed local users to execute arbitrary commands with root privileges and interfere with Sophos protection components. No evidence of exploitation or customer impact was found. Fixes are already released and applied automatically.

EFFECTIVE AUG 5, 2026ENDPOINT · SECURITY · SECURITY ADVISORY · VULNERABILITYSOURCE SOPHOSVIEW SHIFT

SW-000020IXON · IXON VPN CLIENTCRITICALACTION REQUIRED1MO AGO

CISA advisory: CRLF injection in IXON VPN Client <1.4.7 allows root/SYSTEM code execution

CISA republished an advisory (originally issued by IXON on 2026-08-05) describing CVE-2026-75925, a CRLF injection vulnerability (CWE-93) in IXON VPN Client versions before 1.4.7. The flaw allows an attacker to inject directives into a configuration file consumed by a privileged subprocess, enabling command execution as root or SYSTEM. The configuration interface also lacks authentication of the requester (CWE-306, contributing).

EFFECTIVE AUG 5, 2026SECURITY · NETWORK · VULNERABILITY · SECURITY ADVISORYSOURCE CISAVIEW SHIFT