Zaifliklar
Cisco turli mahsulotlarda 34 ta zaiflikni tuzatdi
Kritik darajadagi xavfsizlik kamchiliklari buyruq bajarilishi, autentifikatsiyani chetlab o'tish va XSS hujumlariga olib kelishi mumkin.
Muallif
Ionut Arghire
| 2026-yil 22-oktabr (ET soat 6:05)
*
Chorshanba kuni Cisco Expressway Series, IOS XR, Snort 3 va Unified Communications mahsulotlari bo'yicha 34 ta zaiflikni tuzatganini e'lon qildi.
Expressway Series 10 ta zaiflik, jumladan, CVE-2026-76466 sifatida kuzatilgan kritik darajadagi masofaviy kod bajarish (RCE) xatosi uchun tuzatishlar oldi.
Cisco ma'lumotiga ko'ra, doimiy cookie-fayllardan foydalanish va ma'lum konfiguratsiyalarda mijoz sertifikatlarining yetarli darajada tekshirilmasligi hujumchilarga ma'lumotlar bazasi xizmatiga ulanish va xatoni ishlatish uchun ma'lum masofaviy protsedura chaqiruv (RPC) buyruqlarini chaqirish imkonini berishi mumkin.
"Muvaffaqiyatli ekspluatatsiya hujumchiga ta'sirlangan qurilmaning asosiy operatsion tizimida root sifatida ixtiyoriy buyruqlarni bajarish imkonini berishi mumkin", deb ta'kidlaydi Cisco.
Xavfsizlik kamchiligi Expressway Series X15.5.20 versiyasida tuzatildi, bu versiya shuningdek, o'ziga xos CWE toifasi ostida bir nechta zaifliklarni guruhlagan sakkizta CVE ni ham hal qiladi. O'rtacha darajadagi ma'lumot oshkor qilish xatosi ham tuzatildi.
Cisco Unified Communications mahsulotlarida to'qqizta CVE ni tuzatdi, jumladan, Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME) va Unity Connection.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Eng jiddiylari CVE-2026-76473, CVE-2026-76474 va CVE-2026-76475 — uchta kritik darajadagi muammo bo'lib, ular bir nechta noto'g'ri resurs nazorati, noto'g'ri autentifikatsiya va noto'g'ri kiritish neytrallashuvi kamchiliklarini guruhlaydi.
Bir nechta Cisco mahsulotlari Snort 3 ga ta'sir qiluvchi 13 ta CVE uchun tuzatishlar oldi, jumladan, CVE-2026-20236 va CVE-2026-20043, ular kritik darajadagi noto'g'ri hisoblash va chegaradan tashqari yozish muammolarini guruhlaydi.
Tuzatishlar shuningdek, yuqori darajadagi imtiyozlarni boshqarish, resurs iste'moli va ixtiyoriy buyruq bajarish xatolarini, shuningdek, o'rtacha darajadagi muammolarni ham hal qiladi va Snort 3 3.12.4.0 versiyasiga hamda Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD va IOS XE uchun UTD xavfsizlik yangilanishlariga kiritildi.
Bundan tashqari, Cisco IOS XR da yuqori darajadagi xizmatdan rad etish (DoS) zaifligini (CVE-2026-76505) va Secure Client ning Secure Firewall Posture modulida yuqori darajadagi imtiyoz oshirish xatosini (CVE-2026-76462) tuzatdi.
Cisco ushbu zaifliklardan birortasi yovuz maqsadlarda ishlatilganidan xabardor emasligini aytadi. Qo'shimcha ma'lumotni kompaniyaning xavfsizlik maslahatlari sahifasida va 21-oktabr bildirishnomasida topish mumkin.
Bog'liq: Oracle 2026-yil oktyabr CPU bilan 1200 dan ortiq zaiflikni tuzatdi
Bog'liq: PHP2Shell ekspluatatsiyasi sensorlar birinchi ekspluatatsiya urinishlarini qayd etganidan bir necha kun oldin boshlandi
Bog'liq: Google Chrome ni ClickFix hujumlari va ishonchsiz HTTP ulanishlariga qarshi mustahkamlaydi
Bog'liq: Chrome ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
Yozgan Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlaridan xabardor bo'lish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Signal zaifligi yovuz qo'ng'iroq qiluvchilarga qo'ng'iroqlarni to'xtatishni bloklash imkonini beradi
- Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi
- PHP2Shell ekspluatatsiyasi tuzatishlardan bir necha kun oldin boshlandi
- PHP2Shell tuzatishlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda e'lon qilindi
- Chrome ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
- Brauzerlar eMudhra oraliq CA larni tiklanadigan shaxsiy kalitlar tufayli bloklaydi
- Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq buziladigan kod yozadi
- PHP2Shell: Ochiq kritik PHP kamchiliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
So'nggi yangiliklar
- Sobiq Unit 8200 ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig'di
- Boshqa yangiliklarda: Tor chiqish releylari o'g'irlandi, banklar yovuz AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
- Mirai botnet operatorlari PHP2Shell hujumlariga ASLR chetlab o'tish ekspluatatsiyalari paydo bo'lishi bilan qo'shildi
- Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex dan foydalanadi
- Hujumchilar to'rt oy ichida uchinchi Arista VCO nol kunlik zaifligini ekspluatatsiya qiladi
- Capcom ma'lumotlar buzilishi 11 million kishiga ta'sir qildi
- Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni oshkor qildi
- LiteLLM yangi ta'minot zanjiri hujumida buzildi
Trend
Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob qaytarmoqda
Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex dan foydalanadi
Mirai botnet operatorlari PHP2Shell hujumlariga ASLR chetlab o'tish ekspluatatsiyalari paydo bo'lishi bilan qo'shildi
Boshqa yangiliklarda: Tor chiqish releylari o'g'irlandi, banklar yovuz AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
PHP2Shell tuzatishlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda e'lon qilindi
PHP2Shell: Ochiq kritik PHP kamchiliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni oshkor qildi
Signal zaifligi yovuz qo'ng'iroq qiluvchilarga qo'ng'iroqlarni to'xtatishni bloklash imkonini beradi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalardan xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta axborot byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace dagi AI kirish xavfi
2026-yil 19-oktabr
Google Workspace ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
2026-yil 10 va 11-noyabr
CISO lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiruvchi masalalarni ko'rib chiqish uchun birlashtirgan holda qo'shiling.
Ro'yxatdan o'ting
Harakatdagi odamlar
Cequence Security CMO sifatida Russ Schafer ni tayinladi.
Mona Harrington DHS da Kiber integratsiya bo'yicha yordamchi direktor etib tayinlandi.
iCOUNTER CFO sifatida Mark H. FitzPatrick ni tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
*
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklikdir
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst qirol
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan ko'rish va tahdidlar kuchayishidan oldin ularni to'xtatish imkonini beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaifliklarni aniqlash va ekspluatatsiyani tezlashtirgan sari, virtual tuzatish hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajak uchun katta rejalar tuzgan to'rtta kiber tahdid
- AI, ta'minot zanjiri ochiqligi, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Oxiridan boshlang: Agentik tuzatishni qanday yoqish mumkin
Agentik tuzatish ishonch harakati emas. Biz tanish muammolarni tuzatish haqida gapiryapmiz, notanish xavf haqida hukm chiqarish emas. (Nadir Izrael)
Vulnerabilities
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
By
Ionut Arghire
| October 22, 2026 (6:05 AM ET)
*
Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products.
Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution (RCE) bug tracked as CVE-2026-76466.
According to Cisco, the use of persistent cookies and insufficient validation of client certificates in certain configurations could allow attackers to connect to the database service and invoke specific remote procedure call (RPC) commands to exploit the bug.
“A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device,” Cisco notes.
The security defect was patched in Expressway Series version X15.5.20, which also resolves eight CVEs that group multiple vulnerabilities under their specific CWE category. A medium-severity information disclosure bug was also fixed.
Cisco patched nine CVEs in Unified Communications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME), and Unity Connection.
Advertisement. Scroll to continue reading.
The most severe are CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475, three critical-severity issues that group multiple improper resource control, improper authentication, and improper input neutralization holes.
Multiple Cisco products received patches for 13 CVEs affecting Snort 3, including CVE-2026-20236 and CVE-2026-20043, which group critical-severity incorrect calculation and out-of-bounds write issues.
The fixes also resolve high-severity privilege management, resource consumption, and arbitrary command execution bugs, as well as medium-severity issues, and were included in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.
Additionally, Cisco patched a high-severity denial-of-service (DoS) vulnerability in IOS XR, tracked as CVE-2026-76505, and a high-severity privilege escalation bug in Secure Client’s Secure Firewall Posture module (CVE-2026-76462).
Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page and in its October 21 notification.
Related:Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Related:PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Related:Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Related:Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Signal Vulnerability Lets Malicious Callers Block Hang-Ups
- Splunk, SolarWinds Release Fresh Security Updates
- PHP2Shell Exploitation Started Days Before Patches
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
- Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
- Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Latest News
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 11 Million Impacted by Capcom Data Breach
- Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- LiteLLM Compromised in Fresh Supply Chain Attack
Trending
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)