QCS Security Advisory Desk
Security Advisory Desk.
Monitor network-edge vulnerabilities, known exploitation, affected products, mitigations, and vendor patch guidance without waiting for a weekly editorial cycle.
QCS pathSource-to-action path
- 01Official sourceMonitor vendors and trusted authorities.
- 02Verify contextCheck products, exposure, and evidence.
- 03Set prioritySeparate urgent action from useful reading.
- 04Act or learnPatch, mitigate, investigate, or prepare.
Live intelligence
See the items that can change today's patch or mitigation plan.
Priority combines source severity, known exploitation, remote attack conditions, recency, and network-edge relevance.
high
Cisco / Priority 100
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability
A weakness in certain Cisco Secure Firewall products might allow a nearby attacker to disrupt the device by sending many fake routing messages. This makes the device unexpectedly restart, causing a denial of service. Cisco fixed this issue in updated software versions. There are no simple workarounds, so updating to the fixed software is necessary to protect devices.
- Published
- 18 Sep 2026
- CVSS
- Not scored
- Verified
- 19 Sep 2026
high Exploitation reported
Cisco / Priority 100
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
The Cisco Secure Firewall Management Center software contains a security flaw that lets an attacker connect remotely without logging in and use a fixed low-level user account to access sensitive information. This is risky because the vulnerable account has hard-coded credentials, making it easier for attackers to exploit. If the management interface is not connected to the public internet, the risk is lower. Cisco warns this flaw is serious because it can be combined with other weaknesses to gain higher access levels. Cisco has released updates to fix this problem, and no temporary workarounds exist.
- Published
- 16 Sep 2026
- CVSS
- Not scored
- Verified
- 17 Sep 2026
high Exploitation reported
Cisco / Priority 100
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
A flaw in Cisco Secure Firewall ASA and Threat Defense software's SSL VPN function allows attackers to crash devices remotely, causing denial of service. Attackers send crafted HTTP requests to trigger reloads, disrupting network security. Cisco has released updates to fix this issue, but no temporary workaround exists.
- Published
- 16 Sep 2026
- CVSS
- Not scored
- Verified
- 17 Sep 2026
high
Cisco / Priority 100
Cisco Integrated Management Controller Argument Injection Vulnerabilities
Cisco Integrated Management Controller (IMC) has several security weaknesses in its web-based management interface. These flaws let an attacker who already has some access send malicious inputs that can run any command on the device and gain full system control. Cisco has released software updates to fix these problems, but there are no alternative workarounds. It is important to upgrade your IMC software to protect your systems against potential attacks.
- Published
- 15 Sep 2026
- CVSS
- Not scored
- Verified
- 16 Sep 2026
high
Cisco / Priority 100
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
Certain Cisco desk and video phones have a security flaw that can allow remote attackers to disable the phone by overloading its memory using specially crafted web packets. This causes the phone to stop working until it is manually restarted. To be vulnerable, the phone must be registered with Cisco Unified Communications Manager and have its Web Access feature turned on, which it is not by default. Cisco has released updates that fix this issue, but no temporary workaround fully addresses the problem.
- Published
- 2 Sep 2026
- CVSS
- Not scored
- Verified
- 3 Sep 2026
high
Cisco / Priority 100
Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability
Cisco BroadWorks has a security flaw in the way it processes XML data, which could let an attacker who isn't logged in read sensitive system files. This happens because the system by default allows external references in XML files, which can be exploited by sending specially crafted messages. Cisco has released software updates to fix this issue. There is no workaround available to prevent this problem, so updating is necessary.
- Published
- 19 Aug 2026
- CVSS
- Not scored
- Verified
- 19 Aug 2026
high
Cisco / Priority 100
ClamAV Vulnerabilities Affecting Cisco Products: August 2026
Multiple security flaws have been found in ClamAV, an antivirus scanning component used by some Cisco software. These flaws could let an attacker send specially crafted files to disrupt the scanning process, causing it to stop working temporarily (a denial of service). Cisco has fixed these flaws in newer software versions for affected products. There are no workarounds to prevent these issues, so updating the software is the best way to stay protected.
- Published
- 13 Aug 2026
- CVSS
- Not scored
- Verified
- 13 Aug 2026
high
Cisco / Priority 100
Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability
A security flaw in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature lets attackers cause a device to crash and restart unexpectedly. Attackers do this by sending a specially crafted BEEP SOAP message. This leads to a denial of service (DoS), temporarily disrupting device operation. Cisco has released software updates to fix this issue, and currently, no other ways to avoid this problem exist.
- Published
- 5 Aug 2026
- CVSS
- Not scored
- Verified
- 6 Aug 2026
high
Cisco / Priority 100
Cisco IOS XE Software SNMP Denial of Service Vulnerability
A security flaw in Cisco IOS XE software's SNMP system can let someone with login access crash the device remotely, causing it to restart unexpectedly and disrupt service. This happens because the software doesn't correctly handle certain bad SNMP messages. An attacker could trigger this by sending a malformed SNMP request if they have valid SNMP credentials. Cisco has released updates to fix this problem. There are no simple workarounds, but administrators can apply a mitigation to reduce the risk.
- Published
- 5 Aug 2026
- CVSS
- Not scored
- Verified
- 6 Aug 2026
high
Cisco / Priority 100
Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
A security flaw in Cisco IOS and IOS XE software's Extensible Messaging Client Protocol (XMCP) lets attackers remotely crash affected devices. This happens when attackers send malformed XMCP packets, causing the device to unexpectedly reload and become unavailable. The attacker does not need special access or usernames to cause this issue. Cisco has released software updates to fix the problem. There are no workarounds, but a mitigation involving access control lists can limit which clients can connect, reducing risk.
- Published
- 5 Aug 2026
- CVSS
- Not scored
- Verified
- 6 Aug 2026
high Exploitation reported
Microsoft / Priority 94
CVE-2026-105723: Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
A security flaw in the Windows Distributed File System (DFS) allows unauthorized users to gain higher privileges on affected Windows systems over a network. This means an attacker could perform actions typically restricted to administrators.
- Published
- 13 Oct 2026
- CVSS
- 7.5
- Verified
- 15 Oct 2026
high
Microsoft / Priority 94
CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
A security weakness in Microsoft Exchange Server allows authenticated users to increase their access rights. This means someone with a valid account can exploit the flaw over a network to access other users' mailboxes and read their emails and attachments within the same organization.
- Published
- 2 Oct 2026
- CVSS
- 8.8
- Verified
- 4 Oct 2026