https://patchradar.it/en/Vulnerabilities in firewalls, NAS and routersen https://patchradar.it/en/advisories/cisco-sa-oct2026-node-js-jj3sq19u/https://patchradar.it/en/advisories/cisco-sa-oct2026-node-js-jj3sq19u/Fri, 30 Oct 2026 08:00:00 GMTOn October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release . The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses For information about Splunk products and offerings, see Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026 Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u Security Impact Rating: High https://patchradar.it/en/advisories/cisco-sa-php-october26-jj384daq/https://patchradar.it/en/advisories/cisco-sa-php-october26-jj384daq/Fri, 30 Oct 2026 08:00:00 GMTOn October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp . These vulnerabilities are being referenced as PHP2shell. For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026 . Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq Security Impact Rating: Critical https://patchradar.it/en/advisories/cve-2026-111357/https://patchradar.it/en/advisories/cve-2026-111357/Fri, 30 Oct 2026 08:00:00 GMTIvanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. https://patchradar.it/en/advisories/cisco-sa-emudhra-info-scs22a1r/https://patchradar.it/en/advisories/cisco-sa-emudhra-info-scs22a1r/Fri, 30 Oct 2026 08:00:00 GMTBetween October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates . For information about Splunk products and offerings, see Compromised eMudhra Intermediate Certificate Authorities on Splunk Products - October 2026 . Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r Security Impact Rating: Informational https://patchradar.it/en/advisories/cve-2026-118527/https://patchradar.it/en/advisories/cve-2026-118527/Fri, 30 Oct 2026 08:00:00 GMTIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. https://patchradar.it/en/advisories/cve-2026-76418/https://patchradar.it/en/advisories/cve-2026-76418/Thu, 29 Oct 2026 08:00:00 GMTCisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. https://patchradar.it/en/advisories/cisco-sa-finesse-ssrf-mmsuyugs/https://patchradar.it/en/advisories/cisco-sa-finesse-ssrf-mmsuyugs/Thu, 29 Oct 2026 08:00:00 GMTA vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device. Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS Security Impact Rating: High CVE: CVE-2026-20362 https://patchradar.it/en/advisories/cisco-sa-sdwan-rpa-ehchtzk/https://patchradar.it/en/advisories/cisco-sa-sdwan-rpa-ehchtzk/Wed, 28 Oct 2026 08:00:00 GMTA vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non -root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk Security Impact Rating: Critical CVE: CVE-2026-20127 https://patchradar.it/en/advisories/cisco-sa-asaftd-tunnel-dos-s6mgkb75/https://patchradar.it/en/advisories/cisco-sa-asaftd-tunnel-dos-s6mgkb75/Wed, 28 Oct 2026 08:00:00 GMTA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 Security Impact Rating: High CVE: CVE-2026-76418 https://patchradar.it/en/advisories/cisco-sa-notice-i8z3n6lk/https://patchradar.it/en/advisories/cisco-sa-notice-i8z3n6lk/Wed, 28 Oct 2026 08:00:00 GMTOn November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability information for the remainder of calendar year 2026. The next planned publication of advisories for security-hardened releases will be January 20, 2027. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery . Security Impact Rating: Informational https://patchradar.it/en/advisories/cisco-sa-voice-hardening-twgbh9e3/https://patchradar.it/en/advisories/cisco-sa-voice-hardening-twgbh9e3/Tue, 27 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3 This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . Security Impact Rating: Critical CVE: CVE-2026-76473,CVE-2026-76474,CVE-2026-76475,CVE-2026-76476,CVE-2026-76477,CVE-2026-76478,CVE-2026-76479,CVE-2026-76481 https://patchradar.it/en/advisories/cisco-sa-exwy-hardening-fhcqbvcs/https://patchradar.it/en/advisories/cisco-sa-exwy-hardening-fhcqbvcs/Tue, 27 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release. Cisco has released a software update that addresses these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . Security Impact Rating: High CVE: CVE-2026-76490,CVE-2026-76491,CVE-2026-76492,CVE-2026-76493,CVE-2026-76494,CVE-2026-76495,CVE-2026-76496,CVE-2026-76497 https://patchradar.it/en/advisories/fg-ir-26-187/https://patchradar.it/en/advisories/fg-ir-26-187/Mon, 26 Oct 2026 08:00:00 GMTCVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106073 - (low)This vulnerability affects Node.js 26.x, 24.x, and 22.x. Revised on 2026-10-29 00:00:00 https://patchradar.it/en/advisories/cisco-sa-hardening-snort3-ybgmhtqe/https://patchradar.it/en/advisories/cisco-sa-hardening-snort3-ybgmhtqe/Thu, 22 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787. As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco-owned Open Source Snort 3 engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping. Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . Security Impact Rating: Critical CVE: CVE-2026-20043,CVE-2026-20236,CVE-2026-20291,CVE-2026-20356 https://patchradar.it/en/advisories/cisco-sa-snort3-mime-vulns-bkxjckkt/https://patchradar.it/en/advisories/cisco-sa-snort3-mime-vulns-bkxjckkt/Thu, 22 Oct 2026 08:00:00 GMTMultiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed. An attacker could exploit this vulnerability by sending crafted SMTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-20011 https://patchradar.it/en/advisories/cisco-sa-snort3-misc-dos-6mb22qak/https://patchradar.it/en/advisories/cisco-sa-snort3-misc-dos-6mb22qak/Thu, 22 Oct 2026 08:00:00 GMTMultiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-20019,CVE-2026-20179,CVE-2026-20197,CVE-2026-76489 https://patchradar.it/en/advisories/cisco-sa-snort3-gre-jnpmhrtv/https://patchradar.it/en/advisories/cisco-sa-snort3-gre-jnpmhrtv/Thu, 22 Oct 2026 08:00:00 GMTMultiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the Details section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-20221 https://patchradar.it/en/advisories/cisco-sa-snort3-vba-bufdos-jaufdvn9/https://patchradar.it/en/advisories/cisco-sa-snort3-vba-bufdos-jaufdvn9/Thu, 22 Oct 2026 08:00:00 GMTA vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition. Cisco has released software updates that address this vulnerability. There is a workaround that addresses this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9 This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-20218 https://patchradar.it/en/advisories/cisco-sa-snort3-gtpcodec-dos-rmecfepz/https://patchradar.it/en/advisories/cisco-sa-snort3-gtpcodec-dos-rmecfepz/Thu, 22 Oct 2026 08:00:00 GMTMultiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-76445 https://patchradar.it/en/advisories/cisco-sa-vcs-static-cred-hr7ewz8t/https://patchradar.it/en/advisories/cisco-sa-vcs-static-cred-hr7ewz8t/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root . This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Cisco Expressway Series see Cisco Expressway Series Security Hardening Release: October 2026 . Security Impact Rating: Critical CVE: CVE-2026-76466 https://patchradar.it/en/advisories/fg-ir-26-186/https://patchradar.it/en/advisories/fg-ir-26-186/Wed, 21 Oct 2026 08:00:00 GMTCVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). CVE-2026-109619: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). Revised on 2026-10-28 00:00:00 https://patchradar.it/en/advisories/cisco-sa-notice-qgwhnj6k/https://patchradar.it/en/advisories/cisco-sa-notice-qgwhnj6k/Wed, 21 Oct 2026 08:00:00 GMTOn October 21, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories. To remediate the vulnerabilities that were disclosed on October 21, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery . Snort 3 Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 CVE-2026-20043 CVE-2026-20236 CVE-2026-20291 CVE-2026-20356 Critical 9.0 Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability CVE-2026-76524 High 7.8 Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities CVE-2026-76489 CVE-2026-20019 CVE-2026-20179 CVE-2026-20197 Medium 5.8 Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability CVE-2026-20221 Medium 5.8 Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability CVE-2026-20011 Medium 5.8 Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability CVE-2026-20218 Medium 5.8 Multiple Cisco Products Snort 3 Denial of Service Vulnerability CVE-2026-76445 Medium 5.3 Cisco Expressway and Unified Communications Products Cisco Security Advisory CVE ID Security I Security Impact Rating: Informational https://patchradar.it/en/advisories/cisco-sa-opensrc-snort3-2fxgjpfe/https://patchradar.it/en/advisories/cisco-sa-opensrc-snort3-2fxgjpfe/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vulnerability by connecting to the Snort 3 control channel socket as a local user. A successful exploit could allow the attacker to execute arbitrary commands as well as read and write Snort 3 process memory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Open Source Snort 3, see Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 . Security Impact Rating: High CVE: CVE-2026-76524 https://patchradar.it/en/advisories/cisco-sa-asr9k-tuyxcyxn/https://patchradar.it/en/advisories/cisco-sa-asr9k-tuyxcyxn/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic. The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN Security Impact Rating: High CVE: CVE-2026-76505 https://patchradar.it/en/advisories/cisco-sa-sec-client-priv-esc-muf8ezdm/https://patchradar.it/en/advisories/cisco-sa-sec-client-priv-esc-muf8ezdm/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a series of crafted IPC messages to a local socket. A successful exploit could allow the attacker to perform limited file write operations on the filesystem with SYSTEM or root privileges. Although this vulnerability affects the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux operating systems, this vulnerability could be used to obtain full root privileges on macOS and Linux. For that reason Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm Security Impact Rating: High CVE: CVE-2026-76462 https://patchradar.it/en/advisories/cisco-sa-expressway-inf-disc-vvyqgsts/https://patchradar.it/en/advisories/cisco-sa-expressway-inf-disc-vvyqgsts/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Cisco Expressway Series see Cisco Expressway Series Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-76435 https://patchradar.it/en/advisories/cisco-sa-cucm-access-pw9e8jt2/https://patchradar.it/en/advisories/cisco-sa-cucm-access-pw9e8jt2/Wed, 21 Oct 2026 08:00:00 GMTA vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2 This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories . In addition, for further documentation of improvements and fixes in Cisco Unified CM, see Cisco Unified Communications Products Security Hardening Release: October 2026 . Security Impact Rating: Medium CVE: CVE-2026-76487 https://patchradar.it/en/advisories/cisco-sa-cuic-sql-inject-2qbfwsm5/https://patchradar.it/en/advisories/cisco-sa-cuic-sql-inject-2qbfwsm5/Tue, 20 Oct 2026 08:00:00 GMTA vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5 Security Impact Rating: Medium CVE: CVE-2026-20327 https://patchradar.it/en/advisories/cve-2025-61624/https://patchradar.it/en/advisories/cve-2025-61624/Fri, 16 Oct 2026 08:00:00 GMTFortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. https://patchradar.it/en/advisories/cisco-sa-hardening-meraki-os-drbex9gh/https://patchradar.it/en/advisories/cisco-sa-hardening-meraki-os-drbex9gh/Thu, 15 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH Security Impact Rating: Critical CVE: CVE-2026-76463,CVE-2026-76464,CVE-2026-76467,CVE-2026-76468,CVE-2026-76469,CVE-2026-76470,CVE-2026-76472 https://patchradar.it/en/advisories/cve-2026-21589/https://patchradar.it/en/advisories/cve-2026-21589/Thu, 15 Oct 2026 08:00:00 GMTMultiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. https://patchradar.it/en/advisories/cve-2026-76519/https://patchradar.it/en/advisories/cve-2026-76519/Wed, 14 Oct 2026 08:00:00 GMTCisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. https://patchradar.it/en/advisories/cisco-sa-hardening-esa-dfcrfxkm/https://patchradar.it/en/advisories/cisco-sa-hardening-esa-dfcrfxkm/Wed, 14 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing. Two of them are known to be actively exploited. For more information, see Cisco Secure Email Gateway SQL Injection Vulnerability and Cisco Secure Email Gateway Arbitrary File Write Vulnerability . To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm Security Impact Rating: Critical CVE: CVE-2026-20353,CVE-2026-76440,CVE-2026-76441,CVE-2026-76442,CVE-2026-76443 https://patchradar.it/en/advisories/cisco-sa-esa-afw-zqyjkjxp/https://patchradar.it/en/advisories/cisco-sa-esa-afw-zqyjkjxp/Wed, 14 Oct 2026 08:00:00 GMTA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp For further documentation of improvements and fixes in Cisco Secure Email Gateway, see Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 . Security Impact Rating: Critical CVE: CVE-2026-76519 https://patchradar.it/en/advisories/cve-2026-0322/https://patchradar.it/en/advisories/cve-2026-0322/Wed, 14 Oct 2026 08:00:00 GMTPalo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. https://patchradar.it/en/advisories/fg-ir-26-185/https://patchradar.it/en/advisories/fg-ir-26-185/Tue, 13 Oct 2026 08:00:00 GMTAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-180/https://patchradar.it/en/advisories/fg-ir-26-180/Tue, 13 Oct 2026 08:00:00 GMTAn Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/cve-2026-96951/https://patchradar.it/en/advisories/cve-2026-96951/Tue, 13 Oct 2026 08:00:00 GMTMicrosoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. https://patchradar.it/en/advisories/cve-2026-104935/https://patchradar.it/en/advisories/cve-2026-104935/Tue, 13 Oct 2026 08:00:00 GMTIvanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. https://patchradar.it/en/advisories/fg-ir-26-178/https://patchradar.it/en/advisories/fg-ir-26-178/Tue, 13 Oct 2026 08:00:00 GMTAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-184/https://patchradar.it/en/advisories/fg-ir-26-184/Tue, 13 Oct 2026 08:00:00 GMTAn improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/cisco-sa-ucs-uefi-sb-bypass-eb6xc5gw/https://patchradar.it/en/advisories/cisco-sa-ucs-uefi-sb-bypass-eb6xc5gw/Tue, 13 Oct 2026 08:00:00 GMTA vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software. This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW Security Impact Rating: High CVE: CVE-2026-20293 https://patchradar.it/en/advisories/fg-ir-26-181/https://patchradar.it/en/advisories/fg-ir-26-181/Tue, 13 Oct 2026 08:00:00 GMTAn Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-177/https://patchradar.it/en/advisories/fg-ir-26-177/Tue, 13 Oct 2026 08:00:00 GMTAn improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-179/https://patchradar.it/en/advisories/fg-ir-26-179/Tue, 13 Oct 2026 08:00:00 GMTA Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-176/https://patchradar.it/en/advisories/fg-ir-26-176/Tue, 13 Oct 2026 08:00:00 GMTAn Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-183/https://patchradar.it/en/advisories/fg-ir-26-183/Tue, 13 Oct 2026 08:00:00 GMTA missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/fg-ir-26-182/https://patchradar.it/en/advisories/fg-ir-26-182/Tue, 13 Oct 2026 08:00:00 GMTA Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on 2026-10-13 00:00:00 https://patchradar.it/en/advisories/cisco-sa-napi-rce-r2shwu2j/https://patchradar.it/en/advisories/cisco-sa-napi-rce-r2shwu2j/Thu, 08 Oct 2026 08:00:00 GMTA vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 7, 2026, Security Advisories . For further documentation of improvements and fixes in Cisco NX-OS Software, see Cisco NX-OS Software Security Hardening Release: October 2026 . Security Impact Rating: Critical CVE: CVE-2026-76471 https://patchradar.it/en/advisories/cisco-sa-hardening-ssm-ph77wdhf/https://patchradar.it/en/advisories/cisco-sa-hardening-ssm-ph77wdhf/Wed, 07 Oct 2026 08:00:00 GMTAs part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class — Common Weakness Enumeration (CWE) — and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf Security Impact Rating: Critical CVE: CVE-2026-76480,CVE-2026-76482,CVE-2026-76483,CVE-2026-76484