12OCT

Cisco reaches 100 entries on CISA's list

2 min read

10:55UTC

Cisco took four exploited-flaw listings in three weeks, every one on a security product, and its SD-WAN Manager entry on 30 September was its 100th.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Cisco's 100th exploited-flaw listing landed on SD-WAN Manager, a controller already hit in May.

Cisco took four entries in three weeks on the exploited-flaw catalogue that CISA, the American cyber-defence agency, keeps for federal bodies, all on its shortest deadline⁠¹. They sit on Secure Firewall Management Center, Secure Email Gateway, Identity Services Engine and Cisco Catalyst SD-WAN Manager, the controller for its software-defined wide-area network (SD-WAN) product, which links an organisation's offices.

The SD-WAN Manager listing on 30 September was Cisco's 100th, making it the second vendor to reach 100 after Microsoft, which has 389. SD-WAN Manager was already a repeat target after May's emergency directive ordering agencies to fix an earlier flaw in it.

All four products sit on the control side of a network. A firewall manager writes the rules, an email gateway filters what reaches staff, and Identity Services Engine decides which devices may join. An attacker inside any of them can change the controls rather than work around them.

Deep Analysis

In plain English

Cisco is one of the world's biggest makers of networking equipment, the hardware and software that move data around companies and the internet. The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a list of software flaws attackers are known to use. On 30 September Cisco's 100th flaw went on that list. Only Microsoft has more. The four Cisco flaws listed in September were all in products whose job is protection: managing firewalls, filtering email, deciding who may join a network, and steering traffic between offices.

Deep Analysis

Root Causes

SD-WAN Manager pushes configuration to every branch router in an organisation, so admin rights on it equal control of the wide-area network. CVE-2026-76504 came from how the web interface decoded hex-encoded addresses, a parsing flaw class that recurs wherever old web front ends sit on network kit.

Secure Email Gateway runs AsyncOS, a platform Cisco inherited with its 2007 IronPort purchase, and CVE-2026-76461 was an SQL injection in that inherited code.

Cisco has 18 KEV entries in 2026 to date. The count tracks how many of its products sit exposed on the internet, where attackers scan for them first.

What could happen next?

Risk
Compromise of an SD-WAN controller or identity engine gives attackers policy control over whole networks, so a missed three-day window carries outsized impact.
Meaning
Edge and security products, not desktop software, now drive the fastest growth in Cisco's catalogue count.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In April 2024 Cisco Talos disclosed ArcaneDoor, a state-backed campaign that used two zero-days in Cisco ASA firewalls, CVE-2024-20353 and CVE-2024-20359, to plant implants it named Line Dancer and Line Runner. The target then was also the security device itself, chosen because it sees and controls all traffic.

Counter-parallel: In January 2024 CISA issued Emergency Directive 24-01 on Ivanti Connect Secure, then ordered federal agencies to disconnect the appliances outright by 2 February. Cisco's repeat listings have produced patch orders, never a disconnection order, which marks how far trust in a vendor can fall.

Consensus view: All four September Cisco entries were unauthenticated, remote flaws in products that enforce security: a firewall manager, an email gateway, a network access controller and an SD-WAN controller. Attackers are choosing the devices that already hold privilege over everything behind them, and SD-WAN Manager has been a repeat target since May's emergency directive.

Counter-view: A cumulative KEV count tracks install base and visibility as much as code quality. Microsoft's 389 entries reflect Windows and Office running on most of the world's desktops, and Apple sits at 95 on phones; on that reading Cisco's century measures how much of the world's network edge it owns.

Key tension: Whether KEV totals should be read as a vendor scorecard at all, when the vendors with the biggest footprint will always lead.

Sources:CISA

Mentions:Cisco →Cisco Catalyst SD-WAN Manager →Cisco Secure Firewall Management Center →CISA →Microsoft →Known Exploited Vulnerabilities →Apple →ArcaneDoor →Ivanti →Cisco ASA →AsyncOS →Cisco Secure Email Gateway →IronPort →Cisco Talos →Line Dancer →Line Runner →Ivanti Connect Secure →Emergency Directive 24-01 →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

UAT-8616 keeps Cisco SD-WAN under fire

SD-WAN Manager, under an emergency directive in May, returned to KEV on 30 September.

Occurred 14 May 2026

Read story →

This Event

Cisco reaches 100 entries on CISA's list

Each of the four Cisco flaws sits on a product whose job is to enforce security, so a breach there undoes the control itself.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.