Blahalla

Smashing Security podcast #457: How a cybersecurity boss framed his own employee

grahamcluley.com · 7 months ago

A cybersecurity firm investigated a leak, unaware that the person leading the investigation was the source of the breach, resulting in an employee being wrongly implicated. A defense contractor was recently sentenced to 87 months for selling stolen trade secrets, including zero-day exploits, to a broker with ties to Russia. Authorities have sanctioned a network involved in the theft and sale of cyber tools. Concerns are rising about nation states potentially manipulating artificial intelligence models to influence information and erode trust.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Authenticated Command Injection Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Cisco has identified several vulnerabilities within its Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software. These vulnerabilities, including CVE-2026-20064, CVE-2026-20016, CVE-2026-20017, and CVE-2026-20063, allow authenticated, local attackers to potentially cause denial-of-service conditions or execute arbitrary commands with root-level privileges. The vulnerabilities stem from insufficient input validation within the command-line interface. Software updates are available to address these issues, and there are no available workarounds.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Server Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software, potentially leading to a denial of service. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A tool called the Cisco Software Checker is available to help customers determine their vulnerability status and the earliest software versions that provide fixes. Upgrading Cisco Secure FTD devices should be done through the appropriate Cisco Secure FMC upgrade guide.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Cisco has identified several denial-of-service vulnerabilities within the Remote Access SSL VPN functionality of its Secure Firewall ASA and Secure FTD Software. These vulnerabilities, identified as CVE-2026-20100, CVE-2026-20101, CVE-2026-20103, CVE-2026-20105, and CVE-2026-20106, can be exploited by unauthenticated or authenticated attackers to cause unexpected reloads or memory exhaustion, resulting in a denial of service. The issues stem from insufficient error checking and input validation within the VPN authentication process, Lua interpreter, and HTTP management interfaces. Software updates are available to address these vulnerabilities, and no workarounds are provided.

Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software that could allow unauthorized access. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A tool, the Cisco Software Checker, is available to help customers identify affected software versions and the earliest available fixes. Cisco provides resources to help determine the appropriate software release.

Iranian TV and Social Media Project Defiant and Distorted View of the War

www.nytimes.com · 7 months ago

false

Built a header echo + TLS interception detector to score ISP-level surveillance — looking for feedback on the methodology

ismyispspying.com · 7 months ago

NULL

Bitwarden adds support for passkey login on Windows 11

www.bleepingcomputer.com · 7 months ago

false

Trump Announces A.I. Industry Pledge to Pay for Power

www.nytimes.com · 7 months ago

false

Mail2Shell zero-click attack lets hackers hijack FreeScout mail servers

www.bleepingcomputer.com · 7 months ago

A critical vulnerability in the FreeScout helpdesk platform allows attackers to remotely execute code without user interaction. The flaw, tracked as CVE-2026-28289, bypasses a previous fix for CVE-2026-27636. Hackers can exploit the vulnerability by sending a crafted email attachment, which triggers code execution by bypassing security checks using a zero-width space character. FreeScout versions up to 1.8.206 are affected, and users are strongly advised to update to version 1.8.207 and disable ‘AllowOverrideAll’ in the Apache configuration.

VMware Aria Operations Bug Exploited, Cloud Resources at Risk

www.darkreading.com · 7 months ago

A vulnerability in VMware Aria Operations, identified as CVE-2026-22719, is currently being exploited. This high severity command injection flaw, with a CVSS score of 8.1, allows unauthorized access and potential remote code execution during product migration. Broadcom, the owner of VMware, confirmed reports of exploitation but cannot independently verify them, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. Experts warn that compromising Aria Operations can provide attackers with extensive access to cloud infrastructure, including credentials and network topology.

Windows 10 KB5075039 update fixes broken Recovery Environment

www.bleepingcomputer.com · 7 months ago

false

Fake LastPass support email threads try to steal vault passwords

www.bleepingcomputer.com · 7 months ago

LastPass users are being targeted by a sophisticated phishing campaign impersonating company support staff. Attackers are sending fake email threads designed to appear as legitimate internal communications regarding account changes. These emails trick users into clicking malicious links that lead to fraudulent LastPass login pages, designed to steal vault passwords. LastPass emphasizes that its systems are secure and that support agents will never request a master password.

Cisco warns of max severity Secure FMC flaws giving root access

www.bleepingcomputer.com · 7 months ago

Cisco has released security updates to address two maximum-severity vulnerabilities in its Secure Firewall Management Center software. One vulnerability, CVE-2026-20079, is an authentication bypass flaw allowing attackers to gain root access, while the other, CVE-2026-20131, is a remote code execution vulnerability enabling attackers to execute arbitrary code as root. The remote code execution vulnerability also affects Cisco Security Cloud Control Firewall Management. Cisco reports no evidence of active exploitation or publicly available proof-of-concept code for these flaws.

Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks

www.bleepingcomputer.com · 7 months ago

A sophisticated set of 23 iOS exploits named "Coruna" has been observed in targeted attacks and financially motivated campaigns. The exploit kit, initially used for espionage, now targets cryptocurrency users by stealing wallet recovery phrases, sensitive text strings, and data from Apple Memos. The framework uses five full exploit chains that bypass security mitigations and targets iOS versions 13.0 through 17.2.1, utilizing CVE-2024-23222, a WebKit vulnerability. Google attributes activity to UNC6353 and UNC6691, and suggests a market for "second-hand" zero-day exploits.

Hacker mass-mails HungerRush extortion emails to restaurant patrons

www.bleepingcomputer.com · 7 months ago

Customers of restaurants utilizing the HungerRush point-of-sale system are receiving extortion emails from an attacker threatening to release customer data. The emails, sent via Twilio SendGrid, claim access to millions of customer records including names, emails, and potentially financial information. A possible compromise occurred in October 2025 when an infostealer infected a HungerRush employee's device, allegedly stealing credentials for various corporate systems. HungerRush is investigating the incident and advising customers to be cautious of potential phishing attempts.

Tycoon 2FA Phishing Platform Dismantled in Global Takedown

www.securityweek.com · 7 months ago

Law enforcement and cybersecurity companies have collaborated to dismantle Tycoon 2FA, a phishing-as-a-service platform. The platform allowed attackers to impersonate users and bypass multi-factor authentication, enabling them to access email and cloud accounts. Tycoon 2FA was responsible for a significant portion of phishing attempts, impacting hundreds of thousands of organizations and tens of thousands of Microsoft customers. The takedown involved seizing infrastructure and legal action against individuals, including the platform’s suspected developer.

Lawmakers Question Intel’s Use of Tools From Blacklisted Chinese Firm

www.nytimes.com · 7 months ago

Lawmakers are expressing national security concerns regarding Intel's potential use of technology from ACM Research, a Chinese company that is on a trade blacklist. Intel’s use of these tools could allow China access to Intel's chip-making processes, particularly concerning given Intel is now partly owned by taxpayers. A bipartisan group of senators sent a letter to Intel's CEO requesting answers about the testing of ACM tools, safeguards in place, and measures to prevent taxpayer money from supporting China. The scrutiny highlights challenges facing the company as it attempts to regain industry leadership.

Perplexity AI Browser Flaw Could Let Calendar Invites Access Local Files

www.techrepublic.com · 7 months ago

A security vulnerability in the Perplexity AI-powered Comet browser allowed attackers to potentially access local files through malicious calendar invitations. Researchers discovered that the AI agent could be manipulated to execute harmful instructions hidden within routine content, such as a prompt to search for password documents. The browser’s ability to access the file system through the file:// protocol enabled this access. Perplexity has since released patches to restrict the AI agent's file system access and prevent attackers from hijacking the agent's capabilities.

FBI seizes LeakBase cybercrime forum, data of 142,000 members

www.bleepingcomputer.com · 7 months ago

The Federal Bureau of Investigation, in coordination with international law enforcement agencies through Operation Leak, has seized the LeakBase cybercrime forum. The forum, which had over 142,000 members, was used for buying and selling hacking tools and stolen data. Law enforcement executed search warrants, made arrests, and conducted interviews in multiple countries. The forum’s data, including user accounts, messages, and IP logs, has been secured for evidentiary purposes.

New LexisNexis Data Breach Confirmed After Hackers Leak Files

www.securityweek.com · 7 months ago

LexisNexis has confirmed a data breach after hackers leaked data obtained from its systems. The company states the compromised data primarily consists of legacy information from before 2020, including customer names, user IDs, and support tickets. Hackers claim to have exploited the React2Shell vulnerability and improperly secured AWS instances to steal over 2 gigabytes of data, potentially impacting hundreds of thousands of individuals. The incident follows a previous breach at a third party last year that affected over 360,000 people.

149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict

thehackernews.com · 7 months ago

Following a recent Middle East conflict, a surge of hacktivist activity has targeted organizations across 16 countries. Approximately 149 distributed denial-of-service attacks were launched by 12 groups, primarily impacting the Middle East, with Kuwait, Israel, and Jordan being the most affected. Groups like Keymous+, DieNet, and Nation of Saviors are involved, often combining DDoS attacks with data breaches to advance geopolitical agendas. Cybersecurity experts advise organizations to strengthen defenses against DDoS attacks, phishing, and other cyber threats, particularly those in government, finance, and critical infrastructure sectors.

Stranger Things Meets Cybersecurity: Lessons from the Hive Mind

www.darkreading.com · 7 months ago

false

Europol-coordinated action disrupts Tycoon2FA phishing platform

www.bleepingcomputer.com · 7 months ago

Europol coordinated an international law enforcement operation that has disrupted Tycoon2FA, a phishing-as-a-service platform. The platform, active since August 2023, bypassed multi-factor authentication and compromised accounts belonging to approximately 100,000 organizations worldwide. Tycoon2FA generated tens of millions of phishing emails monthly, impersonating services like Microsoft 365 and Gmail. The platform was sold on Telegram, enabling less-skilled criminals to launch large-scale attacks.

Sprawling FBI, European operation takes down Leakbase cybercriminal forum

therecord.media · 7 months ago

Law enforcement agencies, including the FBI, have dismantled Leakbase, a cybercrime forum that operated since 2021. The operation, called “Operation Leak,” involved actions in over a dozen countries, including shutting down the forum’s infrastructure and seizing its domains. Authorities made 13 arrests, conducted searches, and captured the forum’s database, which contained information from over 142,000 registered members. The forum facilitated the sale of stolen credentials and access to U.S.-based networks, potentially impacting critical infrastructure.

Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco ASA, FMC, and FTD software. This vulnerability is a SQL injection flaw, and Cisco recommends upgrading to a fixed software release to fully remediate the issue. Customers can use the Cisco Software Checker to determine their exposure and the appropriate upgrade path. Workarounds and mitigations are considered temporary solutions.

Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco ASA, Firepower Management Center, and Firepower Threat Defense software. This vulnerability allows for command injection and is considered a serious security risk. Cisco recommends upgrading to a fixed software release to fully remediate the issue. Customers can use the Cisco Software Checker tool to determine their exposure and find the earliest fixed release.

Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

www.microsoft.com · 7 months ago

A new phishing-as-a-service platform called Tycoon2FA has emerged, impacting numerous organizations worldwide. This platform allows less-skilled cybercriminals to bypass multi-factor authentication by impersonating trusted brands and stealing login credentials. Microsoft recommends bolstering defenses with phishing-resistant MFA, enhanced cloud protection, and leveraging tools like Microsoft Defender and Security Copilot. Organizations can also improve detection by using threat intelligence and advanced hunting queries.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SAML Reflected Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software. The issue is a reflected cross-site scripting vulnerability, which Cisco considers a temporary issue until an upgrade is possible. A tool, the Cisco Software Checker, is available to help users determine their exposure and the earliest fixed software release. Upgrading to a fixed software release is the recommended solution to fully remediate the vulnerability.

Cisco Secure Firewall Adaptive Security Appliance Software TCP Flood Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance software could cause denial of service. Attackers can exploit this by sending crafted traffic, leading to dropped TCP SYN packets and preventing connections. This impacts remote management, VPNs, and TCP-based network protocols. Cisco has released software updates to resolve the issue, and no workarounds are available.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA Software and Secure FTD Software when deployed in cluster configurations. The issue allows for an access control list bypass. To determine if a device is part of a cluster, administrators can use the "show cluster info" command. Cisco Secure Firewall Management Center software is not affected.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Lua Code Injection Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A Cisco Software Checker tool is available to help determine exposure and identify the earliest fixed release. Customers can use this tool by selecting the advisories, software, platform, and entering a release number.

Cisco Secure Firewall Threat Defense Software Snort 3 SSL Memory Management Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall Threat Defense Software when Snort 3 is enabled alongside an SSL policy. This condition creates a denial-of-service risk by causing memory management issues. Administrators can determine if their devices are vulnerable by checking for SSL policy configurations through the command-line interface or web interfaces managed by Cisco Secure Firepower Device Manager, Cisco Secure Firewall Management Center, or Cisco Defense Orchestrator. This vulnerability does not impact products like Cisco Meraki or Cisco Secure Firewall ASA Software.

Cisco Secure Firewall Threat Defense Software TLS with Snort 3 Detection Engine Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A denial-of-service vulnerability exists in the TLS cryptography functionality of the Snort 3 Detection Engine within Cisco Secure Firewall Threat Defense Software. An unauthenticated attacker can exploit this by sending a crafted TLS packet, causing the Snort 3 Detection Engine to unexpectedly restart and disrupt network traffic. This issue is tracked as CVE-2026-20006 and affects systems where Snort 3 is enabled, SSL/decryption policies are in place, and specific TLS versions are blocked or unsupported ciphers are handled. Cisco has released software updates and workarounds to address the vulnerability, which does not impact TLS 1.3.

Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Several Cisco products are vulnerable to denial-of-service attacks due to issues in the Snort 3 Detection Engine. Unauthenticated attackers can trigger restarts of the Snort 3 engine, disrupting packet inspection. Affected products include Cisco Secure Firewall Threat Defense Software, Cisco IOS XE devices, Cisco Cyber Vision, and open-source Snort 3, along with Cisco ASA, FMC, and Meraki devices. Software updates are the only available solution for these vulnerabilities, which have been assigned CVE-2026-20005, CVE-2026-20065, CVE-2026-20066, CVE-2026-20067, CVE-2026-20068, and CVE-2026-20068.

Multiple Cisco Products Snort 3 Visual Basic for Applications Denial of Service Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Denial-of-service vulnerabilities affect several Cisco products, including Secure Firewall Threat Defense, IOS XE with Unified Threat Defense enabled, and Cyber Vision. These vulnerabilities, identified as CVE-2026-20053, CVE-2026-20054, CVE-2026-20057, and CVE-2026-20058, stem from issues in the Snort 3 Visual Basic for Applications decompression engine. A remote attacker can exploit these flaws to trigger crashes or restarts of the Snort 3 Detection Engine; a workaround involves disabling VBA decompression, but software updates are the preferred solution. No public exploits of the vulnerabilities have been reported.

Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Cisco has identified SQL injection vulnerabilities in its Secure Firewall Management Center software. These vulnerabilities, identified as CVE-2026-20002, CVE-2026-20001, and CVE-2026-20003, allow authenticated, remote attackers to potentially access databases and read system files. Successful exploitation requires valid user credentials and specific administrative roles for some vulnerabilities. Cisco has released software updates to address these issues and recommends upgrading to a fixed release for full remediation.

Cisco Webex Services Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability in Cisco Webex services allowed an unauthenticated attacker to potentially launch a cross-site scripting attack. The issue stemmed from improper filtering of user-supplied input, which could be exploited through a malicious link. Cisco has resolved the vulnerability, and no customer action is required. No workarounds are available, and there have been no public reports of exploitation.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Cisco has identified vulnerabilities in the Internet Key Exchange Version 2, or IKEv2, feature of Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software. These vulnerabilities could allow an attacker to cause a denial of service, potentially impacting network services. Three CVEs are associated with this: CVE-2026-20013, CVE-2026-20014, and CVE-2026-20015. Cisco has released software updates to address these issues, and there are no available workarounds.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software OSPF Protocol Vulnerabilities

sec.cloudapps.cisco.com · 7 months ago

Multiple vulnerabilities have been identified in the Open Shortest Path First, or OSPF, protocol within Cisco Secure Firewall ASA and Secure FTD Software. These vulnerabilities can allow an attacker to trigger a denial-of-service condition, forcing the device to reload unexpectedly. Exploitation does not depend on other vulnerabilities and may not affect all software releases. The affected CVEs are CVE-2026-20020, CVE-2026-20024, CVE-2026-20025, CVE-2026-20022, CVE-2026-20023, and CVE-2026-20021, each carrying a medium security impact rating. Software updates are available to resolve these issues, and no workarounds are provided.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software. This allows an unauthenticated attacker to potentially execute malicious code through a cross-site scripting attack. The issue stems from improper input validation and requires an upgrade to fixed software to resolve. There are no available workarounds.

Cisco Secure Firewall Threat Defense Software SSL Decryption Policy Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability affecting Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software has been identified. Cisco recommends upgrading to a fixed software release to remediate the issue and prevent future exposure. A Cisco Software Checker tool is available to determine vulnerability exposure and identify the earliest fixed releases. Users can check specific software releases by selecting advisories, software, platform, and entering a release number.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software, allowing for client-side request smuggling. Cisco recommends upgrading to a fixed software release to fully remediate the issue and avoid future exposure. A tool, the Cisco Software Checker, is available to help users determine their vulnerability status and identify the earliest fixed release. Customers can use the Software Checker tool or a form to identify affected software releases.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IPsec Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software that could lead to a denial of service. Cisco recommends upgrading to a fixed software release to fully resolve the issue. Customers can use the Cisco Software Checker tool to determine their exposure and the earliest available fix. Specific software versions and upgrade instructions are available through Cisco’s documentation.

ClamAV Cascading Style Sheets Image Parsing Error Handling Denial of Service Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in several Cisco Secure Endpoint connectors, potentially leading to a denial-of-service condition. The issue stems from an error in how images are parsed within Cascading Style Sheets. Affected platforms include the Linux, Mac, and Windows connectors, as well as Cisco Secure Endpoint Private Cloud. To resolve this, users are advised to upgrade to software releases 1.28.11 for Linux, 1.27.21 for Mac, 8.6.01 for Windows, and 4.2.7 or later for Private Cloud.

Cisco Secure Firewall Management Center Software Command Injection Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall Management Center software, potentially allowing an authenticated, local attacker to execute commands as root. This is due to insufficient restrictions during remediation module operation when the system is in lockdown mode. Attackers with administrative credentials could exploit this issue, and there are no available workarounds. Cisco has released software updates to address the vulnerability, and users are urged to upgrade.

Cisco Secure Firewall Adaptive Security Appliance Software SSH Partial Private Key Authentication Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software that allows a bypass of SSH partial private key authentication. Cisco recommends upgrading to a fixed software release to fully remediate this issue. A tool, the Cisco Software Checker, is available to help customers identify their exposure and the earliest fixed releases. Users can select advisories, software, platform, and release number to check for vulnerabilities.

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Path Traversal Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability has been identified in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software. Cisco recommends upgrading to a fixed software release to fully remediate this exposure. Customers can use the Cisco Software Checker tool to determine their vulnerability status and identify the earliest fixed release. Upgrading Cisco Secure FTD devices should be done through the appropriate upgrade guide.

Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in Cisco Secure Firewall ASA, Secure FMC, and Secure FTD software, allowing for Snort Deep Inspection bypass. Cisco recommends upgrading to a fixed software release to fully resolve the issue and prevent future exposure. A tool, the Cisco Software Checker, is available to help customers determine which software releases are affected and identify the earliest fixes. Users can specify search criteria such as software, platform, and release number to assess vulnerability status.

Cisco Secure Firewall Adaptive Security Appliance Software Multiple Context Mode SCP Unauthorized File Access Vulnerability

sec.cloudapps.cisco.com · 7 months ago

A vulnerability exists in the Cisco Secure Firewall Adaptive Security Appliance Software's multiple context mode due to improper access controls with the Secure Copy Protocol. An authenticated attacker with administrative privileges in one context could potentially copy files to or from another context, including sensitive configuration files. The vulnerability is tracked as CVE-2026-20062, and impacts devices where multiple context mode is enabled and the Cisco SSH stack is active. Cisco recommends upgrading to a fixed software release to resolve this issue.