Network device security digests

Daily intelligence on vulnerabilities and attacks affecting firewalls, VPN gateways, routers, switches, wireless controllers, load balancers and SD-WAN edge — with the upgrade and hardening actions to take, for current and legacy systems. Unrelated security news is filtered out.

📡 Subscribe by RSS · 🏢 Browse by vendor · 🧠 AI & network devices

📋 Latest edition — 2026-09-18

20 items · 4 critical · KEV: CVE-2026-76460

Cisco ISE authentication bypass CVE-2026-76460 (CVSS 10.0) is on KEV with a 19 September deadline

Cisco has confirmed active exploitation of CVE-2026-76460, a maximum-severity authentication bypass in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). Cisco attributes it to insufficient authentication control on an API endpoint, which lets an unauthenticated, remote attacker bypass the web-based management interface and gain unauthorized access to the device. CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-09-16 with a remediation due date of 2026-09-19 under BOD 26-04; ransomware use is listed as unknown.

Do this first

Inventory every ISE and ISE-PIC node (including standby, PAN and MnT personas) with its running patch level, and apply the fixed release named in the Cisco advisory for CVE-2026-76460 - check the vendor advisory for the fixed release, it is not stated in these sources.
US federal agencies: the BOD 26-04 due date for CVE-2026-76460 is 2026-09-19. If you cannot meet it, follow CISA’s instruction to apply vendor mitigations or discontinue use, and record the decision.
Remove the ISE administrative and API interfaces from any internet-facing or user-reachable path today; permit them only from a dedicated management VLAN or out-of-band network and jump hosts.
Assume pre-patch compromise on any ISE node that was reachable from an untrusted network: rotate admin credentials, API keys, pxGrid and node certificates, RADIUS/TACACS+ shared secrets and any ERS/OpenAPI service accounts after upgrading.
Review ISE for unexpected admin users, changed authorisation policies and profiles, new network device entries and modified shared secrets - a policy change is the quiet form of this compromise.

In summary

Cisco ISE CVE-2026-76460 (CVSS 10.0, unauthenticated authentication bypass on an API endpoint) is actively exploited and on CISA KEV with a 2026-09-19 due date - patch the identity platform first.
Cisco’s September 2026 ASA/FTD/FMC hardening release states two of its flaws are already exploited, both in Firewall Management Center: a static credential issue and an authentication bypass.
Six further Cisco ASA/FTD advisories land at once - four denial of service (IKEv2 certificate, DTLS on 3100/4200, EIGRP, TCP DNS), one syslog CPU exhaustion, and an Object Group Search ACL bypass that lets blocked traffic through.
Check Point Security Management and Log Servers have a critical unauthenticated remote code execution as root, fixed via LivePatch, with no reported exploitation - this is the box that holds firewall policy.
Three ZDI advisories cover authenticated Cisco ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20235); they chain behind the auth bypass rather than standing alone.
No source in this window states a fixed version string. Take exact fixed releases from the vendor advisories, not from press coverage.

🛠️ Solutions this edition

Cisco — Confirm the running ASA, FTD and FMC versions against Cisco’s fixed-release table in the hardening advisory - check the vendor advisory for the fixed release, no version is stated in this source.
Cisco — Patch FMC before the managed FTD devices, then upgrade firewalls in the change window, HA pair secondary first, and verify policy deploy afterwards.
Cisco — Patch ISE and ISE-PIC to the fixed release named in the Cisco advisory - check the vendor advisory for the fixed release.
Cisco — Meet or formally document the CISA BOD 26-04 due date of 2026-09-19 if you are in scope; otherwise apply vendor mitigations or discontinue use as the KEV entry instructs.
Cisco — Upgrade ISE to the fixed release stated in the Cisco advisory - check the vendor advisory for the fixed release.
Cisco — Before the upgrade, capture ISE logs and configuration for forensics; patching overwrites some of the evidence you would want later.
Check Point — Confirm LivePatch is enabled and has actually applied the fix on every Security Management Server and Log Server - verify the installed patch level rather than assuming the channel delivered it.
Check Point — Remove management server access from any untrusted or internet-facing network; SmartConsole and management traffic belong on a dedicated management VLAN or out-of-band network.

Today’s items

CRITICAL — Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026
Cisco’s September 2026 hardening release for ASA, FTD and FMC software fixes multiple internally found flaws, two of them already exploited in Firewall Management Center.
CRITICAL — Cisco Zero-Day Highlights API Endpoint Authentication Issues
CVE-2026-76460, a CVSS 10.0 authentication bypass on a Cisco ISE API endpoint, is on CISA’s KEV list with a 2026-09-19 remediation deadline.
CRITICAL — Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco confirms active exploitation of a maximum-severity ISE authentication bypass caused by insufficient authentication control on an API endpoint.
CRITICAL — Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Check Point Security Management and Log Servers accept unauthenticated network requests that run code as root; a LivePatch fix is out with no reported exploitation.
HIGH — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability
An unauthenticated attacker can crash Cisco ASA and FTD firewalls by starting an IKEv2 VPN connection with a crafted certificate, and Cisco states there is no workaround.
HIGH — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability
Crafted DTLS traffic reloads Cisco Secure Firewall 3100 and 4200 Series appliances running ASA or FTD software; Cisco states workarounds exist.

Read the full edition →

Browse

By vendor and device type — pick a vendor (Cisco, Fortinet, Palo Alto, Check Point…) and drill into firewalls, VPN gateways, routers or switches.

By week, month and year — everything published in a given period, grouped by vendor.

AI & network devices — AI-assisted attacks, AI on network gear, prompt injection against network management.

All editions

Network Device Security Digest - 2026-09-18 — 4 critical (20 items, KEV: CVE-2026-76460)
Network Device Security Digest - 2026-09-17 — 2 critical (6 items, KEV: CVE-2026-76461)

Automated, reviewed before publication. Always verify version numbers against the vendor advisory before scheduling a change.