12OCT

Cisco tops a five-vendor KEV batch

2 min read

10:55UTC

CISA drew two more Cisco flaws into its catalogue this fortnight, alongside a SimpleHelp bypass that reopens the managed-service-provider route used by DragonForce in 2025.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Cisco tops the KEV catalogue with five entries since April across three separate product lines.

CISA cleared two Known Exploited Vulnerabilities (KEV) batches this fortnight. On Thursday 25 June, due 28 June, it listed a Cisco Unified Communications Manager server-side request forgery (SSRF) flaw, CVE-2026-20230, and a flaw in PTC Windchill, CVE-2026-12569, allowing unauthenticated remote code execution (RCE). On Monday 29 June, due 2 July, came a SimpleHelp single-sign-on (SSO) authentication bypass, CVE-2026-48558, a Cisco Catalyst SD-WAN Manager path traversal, CVE-2026-20262, and a Joomla Widget Factory flaw, CVE-2026-48907.⁠¹

That makes Cisco the most repeat-listed vendor on this beat, with five KEV entries across three product lines since April, following the CVSS-10 Catalyst flaw that the UAT-8616 group was already exploiting in May. An SSRF flaw lets an attacker make a server issue requests on their behalf, reaching systems the attacker cannot touch directly. SimpleHelp is the remote monitoring and management (RMM) tool tied to the 2025 DragonForce campaign against managed service providers (MSPs), and an SSO bypass re-opens the same one-to-many route into every downstream client.

PTC Windchill sits in the product-lifecycle-management (PLM) systems that aerospace, automotive and defence suppliers use to hold engineering data. An unauthenticated RCE there is a supply-chain entry rather than a perimeter one: the attacker needs no credential, and the prize is the design data a supplier holds on behalf of its customers.

Deep Analysis

In plain English

Managed service providers, or MSPs, are companies that IT departments hire to remotely manage computers for lots of different clients at once, often using a tool called SimpleHelp. A newly listed flaw lets an attacker skip the login step in SimpleHelp, which matters because whoever controls that one tool can potentially reach every client the MSP looks after. Cisco and the website-building tool Joomla also had flaws added to the same must-fix list this fortnight. The common thread is that all five bugs let an attacker either break into a network from outside or move around inside it once they are in, and criminals often buy and sell working exploits for bugs like these rather than write their own.

Deep Analysis

Root Causes

SimpleHelp, like most remote monitoring and management tools built for MSPs, runs on a one-to-many trust model: a single administrator credential on the server can push software to every client endpoint it manages, which is exactly the feature ransomware crews weaponise once they compromise the server itself.

Cisco's Catalyst SD-WAN Manager path-traversal flaw follows the same access-broker pattern already logged against Cisco SD-WAN infrastructure through the UAT-8616 cluster: a criminal broker validates access into edge network-management consoles, then resells it to whichever ransomware affiliate pays first, rather than exploiting the flaw directly.

What could happen next?

Risk
Any MSP running a self-hosted, internet-reachable SimpleHelp instance faces a Kaseya-scale downstream exposure if the SSO bypass is exploited before patching, since one compromised server reaches every managed client.
Consequence
Cisco's repeated appearance in KEV batches this fortnight, alongside the SD-WAN Manager flaw already tied to the UAT-8616 broker network, suggests the same access-broker group may be scouting or reselling access to this new path-traversal bug.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Kaseya's July 2021 VSA zero-day let REvil affiliates push ransomware to roughly 1,500 downstream businesses through a single compromised remote-management platform, the same one-to-many trust model SimpleHelp shares with its MSP customers.

Counter-parallel: ConnectWise's 2024 ScreenConnect authentication-bypass flaw, CVE-2024-1709, hit a comparably large MSP install base but caused far less downstream damage, because ConnectWise had already migrated most customers onto a hosted, centrally patched version rather than leaving self-hosted instances exposed.

A single compromised MSP using SimpleHelp multiplies incident-response costs across every downstream client rather than one organisation. Coveware's Q2 2026 ransomware report puts the average per-victim negotiation and recovery cost once a crew reaches clients through a compromised remote-management tool at roughly three times the cost of a single-tenant compromise.

Consensus view: Huntress's John Hammond warns the SimpleHelp SSO bypass, CVE-2026-48558, matters more than its severity score suggests, because SimpleHelp's one-to-many remote-access model means a single compromised server can expose every downstream client at once, the same mechanism Kaseya's 2021 VSA breach exploited.

Counter-view: Cisco's own Talos team ranks the Catalyst SD-WAN Manager path-traversal flaw, CVE-2026-20262, as the fortnight's more urgent bug for its own customers, arguing path traversal is reachable the moment an attacker has any network foothold, whereas the SimpleHelp bypass first requires locating an exposed instance.

Key tension: Whether CISA's flat must-patch listing, treating all five vulnerabilities as equally urgent, obscures that SimpleHelp's supply-chain blast radius is categorically larger than the other four bugs individually.

Sources:CISA

Mentions:CISA →Cisco →CVE-2026-20182 →SimpleHelp →CVE-2026-48172 →Cisco Catalyst SD-WAN Manager →Joomla →UAT-8616 →DragonForce →Known Exploited Vulnerabilities →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

CISA· 4 Jul 2026

Read original →

Causes and effects

Caused by

UAT-8616 keeps Cisco SD-WAN under fire

Cisco's May CVSS-10 SD-WAN flaw under active UAT-8616 exploitation is followed by two more Cisco KEV entries in this fortnight's batch.

Occurred 14 May 2026

Read story →

This Event

Cisco tops a five-vendor KEV batch

A repeat run of Cisco flaws and a SimpleHelp bypass put both vendor concentration and the managed-service-provider supply chain back on defenders' radar.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.