{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:32.433Z","products":["cisco"],"actNowTotal":7,"results":[{"query":"cisco","matched":7,"actNow":7,"events":[{"id":"early-cve-2026-76418","url":"https://securitythreatpulse.com/events/early-cve-2026-76418","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: attackers can knock it offline","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 13 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access.","tier":"today","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","The confirmation is 13 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-76418"],"vendor":"Cisco","product":"Cisco Secure Firewall Adaptive Security Appliance (ASA) Software","affectedProducts":[{"kind":"direct","slug":"cisco/ciscosecurefirewalladaptivesecurityapplianceasasoftware","vendor":"Cisco","product":"Cisco Secure Firewall Adaptive Security Appliance (ASA) Software","evidence":["kev","cpe"],"vendorKey":"cisco","productKey":"ciscosecurefirewalladaptivesecurityapplianceasasoftware"},{"kind":"direct","slug":"cisco/ciscosecurefirewallthreatdefenseftdsoftware","vendor":"Cisco","product":"Cisco Secure Firewall Threat Defense (ftd) Software","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscosecurefirewallthreatdefenseftdsoftware"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","cvss":8.6,"epss":0.00821,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-10-29","kevDueDate":"2026-11-01","firstSeenAt":"2026-10-29T12:54:01.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-06T04:48:11.072Z"},{"id":"kev-2026-09-16-cisco-identity-services-engine","url":"https://securitythreatpulse.com/events/kev-2026-09-16-cisco-identity-services-engine","title":"Cisco Identity Services Engine: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 55 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 76%.","tier":"now","rankScore":7,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public.","3 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-76460"],"vendor":"Cisco","product":"Identity Services Engine","affectedProducts":[{"kind":"direct","slug":"cisco/identityservicesengine","vendor":"Cisco","product":"Identity Services Engine","evidence":["kev"],"vendorKey":"cisco","productKey":"identityservicesengine"},{"kind":"direct","slug":"cisco/ciscoidentityservicesenginesoftware","vendor":"Cisco","product":"Cisco Identity Services Engine Software","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscoidentityservicesenginesoftware"},{"kind":"direct","slug":"cisco/ciscoisepassiveidentityconnector","vendor":"Cisco","product":"Cisco Ise Passive Identity Connector","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscoisepassiveidentityconnector"}],"category":{"id":"identity","label":"Logins and access","why":"It controls who can log in to what.","doThis":"Patch it and review who has admin access."},"summary":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","cvss":10,"epss":0.75599,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-16","kevDueDate":"2026-09-19","firstSeenAt":"2026-09-16T00:00:00.000Z","updatedAt":"2026-11-10T20:30:23.688Z","newestEvidenceAt":"2026-11-02T14:03:09.701Z"},{"id":"kev-2026-11-10-cisco-broadworks","url":"https://securitythreatpulse.com/events/kev-2026-11-10-cisco-broadworks","title":"Cisco BroadWorks: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 83 days old, so many systems are likely still unpatched.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 1 day old.","6 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-20320"],"vendor":"Cisco","product":"BroadWorks","affectedProducts":[{"kind":"direct","slug":"cisco/broadworks","vendor":"Cisco","product":"BroadWorks","evidence":["kev"],"vendorKey":"cisco","productKey":"broadworks"},{"kind":"direct","slug":"cisco/ciscobroadworks","vendor":"Cisco","product":"Cisco Broadworks","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscobroadworks"},{"kind":"direct","slug":"cisco/broadworksapplicationdeliveryplatform","vendor":"Cisco","product":"Broadworks Application Delivery Platform","evidence":["cpe"],"vendorKey":"cisco","productKey":"broadworksapplicationdeliveryplatform"},{"kind":"direct","slug":"cisco/broadworksapplicationserver","vendor":"Cisco","product":"Broadworks Application Server","evidence":["cpe"],"vendorKey":"cisco","productKey":"broadworksapplicationserver"},{"kind":"direct","slug":"cisco/broadworksprofileserver","vendor":"Cisco","product":"Broadworks Profile Server","evidence":["cpe"],"vendorKey":"cisco","productKey":"broadworksprofileserver"},{"kind":"direct","slug":"cisco/broadworksxtendedservicesplatform","vendor":"Cisco","product":"Broadworks Xtended Services Platform","evidence":["cpe"],"vendorKey":"cisco","productKey":"broadworksxtendedservicesplatform"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.","cvss":7.5,"epss":0.00385,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-11-10","kevDueDate":"2026-11-24","firstSeenAt":"2026-11-10T00:00:00.000Z","updatedAt":"2026-11-11T06:30:19.435Z","newestEvidenceAt":"2026-11-11T07:04:54.033Z"},{"id":"kev-2026-10-14-cisco-secure-email-gateway","url":"https://securitythreatpulse.com/events/kev-2026-10-14-cisco-secure-email-gateway","title":"Cisco Secure Email Gateway: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 27 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The severity score is critical (9.8).","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-76519"],"vendor":"Cisco","product":"Secure Email Gateway","affectedProducts":[{"kind":"direct","slug":"cisco/secureemailgateway","vendor":"Cisco","product":"Secure Email Gateway","evidence":["kev"],"vendorKey":"cisco","productKey":"secureemailgateway"},{"kind":"direct","slug":"cisco/ciscosecureemail","vendor":"Cisco","product":"Cisco Secure Email","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscosecureemail"}],"category":{"id":"email","label":"Email","why":"It carries internal and customer mail.","doThis":"Patch it, or ask your email provider whether they have."},"summary":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","cvss":9.8,"epss":0.06227,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-14","kevDueDate":"2026-10-17","firstSeenAt":"2026-10-14T00:00:00.000Z","updatedAt":"2026-11-10T16:30:22.669Z","newestEvidenceAt":"2026-11-07T11:13:03.187Z"},{"id":"kev-2026-09-14-cisco-secure-email-gateway","url":"https://securitythreatpulse.com/events/kev-2026-09-14-cisco-secure-email-gateway","title":"Cisco Secure Email Gateway: attackers can read or change its database","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 57 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The severity score is critical (9.8).","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-76461"],"vendor":"Cisco","product":"Secure Email Gateway","affectedProducts":[{"kind":"direct","slug":"cisco/secureemailgateway","vendor":"Cisco","product":"Secure Email Gateway","evidence":["kev"],"vendorKey":"cisco","productKey":"secureemailgateway"},{"kind":"direct","slug":"cisco/ciscosecureemail","vendor":"Cisco","product":"Cisco Secure Email","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscosecureemail"}],"category":{"id":"email","label":"Email","why":"It carries internal and customer mail.","doThis":"Patch it, or ask your email provider whether they have."},"summary":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","cvss":9.8,"epss":0.4016,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-14","kevDueDate":"2026-09-17","firstSeenAt":"2026-09-14T00:00:00.000Z","updatedAt":"2026-11-10T16:30:22.669Z","newestEvidenceAt":"2026-11-06T15:30:56.822Z"},{"id":"kev-2026-09-09-cisco-secure-firewall-management-cen","url":"https://securitythreatpulse.com/events/kev-2026-09-09-cisco-secure-firewall-management-cen","title":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 249 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The severity score is critical (10.0). The exploit prediction score is 89%.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-20079"],"vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","affectedProducts":[{"kind":"direct","slug":"cisco/securefirewallmanagementcenterfmcandsecuritycloudcontrolsccfirewallmanagement","vendor":"Cisco","product":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","evidence":["kev"],"vendorKey":"cisco","productKey":"securefirewallmanagementcenterfmcandsecuritycloudcontrolsccfirewallmanagement"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.","cvss":10,"epss":0.88658,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-09","kevDueDate":"2026-09-12","firstSeenAt":"2026-09-09T00:00:00.000Z","updatedAt":"2026-11-08T17:22:40.179Z","newestEvidenceAt":"2026-10-24T23:23:07.997Z"},{"id":"kev-2026-09-30-cisco-catalyst-sd-wan-manager","url":"https://securitythreatpulse.com/events/kev-2026-09-30-cisco-catalyst-sd-wan-manager","title":"Cisco Catalyst SD-WAN Manager: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 41 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access. The severity score is critical (9.8).","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-76504"],"vendor":"Cisco","product":"Catalyst SD-WAN Manager","affectedProducts":[{"kind":"direct","slug":"cisco/catalystsdwanmanager","vendor":"Cisco","product":"Catalyst SD-WAN Manager","evidence":["kev"],"vendorKey":"cisco","productKey":"catalystsdwanmanager"},{"kind":"direct","slug":"cisco/ciscocatalystsdwanmanager","vendor":"Cisco","product":"Cisco Catalyst SD-WAN Manager","evidence":["cpe"],"vendorKey":"cisco","productKey":"ciscocatalystsdwanmanager"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","cvss":9.8,"epss":0.38928,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-30","kevDueDate":"2026-10-03","firstSeenAt":"2026-09-30T00:00:00.000Z","updatedAt":"2026-11-10T13:30:21.882Z","newestEvidenceAt":"2026-11-08T13:00:26.001Z"}]}]}