Affected Vendors
- Cisco: 85 CVEs (29 critical, 27 high, 29 medium)
- ASUS: 3 CVEs (1 high, 2 none)
- TP-Link: 1 CVE (none)
- OpenWrt / DD-WRT: 1 CVE (none)
Overview
This week brings a significant security event: 89 new CVEs across router and network infrastructure vendors, with Cisco dominating the advisory landscape. The headline is stark: 29 critical vulnerabilities, many with perfect CVSS 10.0 scores affecting core authentication and administrative access mechanisms. This is a high-priority week for any organization running Cisco network security appliances or identity infrastructure.
Critical Cisco Identity Services Engine (ISE) Flaws
Four vulnerabilities in Cisco ISE and ISE-PIC merit immediate attention. CVE-2026-76460 and CVE-2026-76423 both carry CVSS 10.0 ratings and allow unauthenticated, remote attackers to bypass authentication or gain full administrative access via API endpoints. CVE-2026-20130 and CVE-2026-20192 follow the same pattern. These are not theoretical risks—they require no credentials and no user interaction. If your environment runs ISE for network access control or guest management, patch immediately. Check Cisco's security advisories for available updates and workarounds.
Cisco Firewall and Dashboard Critical Issues
Beyond ISE, Cisco's broader security product line was hit hard. CVE-2026-20332 and CVE-2026-20329 affect Secure Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software (CVSS 9.9). CVE-2026-20322 and CVE-2026-20325 target Nexus Dashboard (CVSS 9.9). CVE-2026-20324 involves the sftunnel inter-device communication protocol in Firewall Management Center (FMC)—this one requires authentication but allows remote code execution on a critical management component.
For organizations using Cisco's unified security appliance or data center fabric management platforms, this is an elevated-urgency week. Review your patch schedules and test updates in non-production environments before rolling out.
Smaller Vendor Issues
ASUS reported three CVEs, including CVE-2026-93116 (high, CVSS 7.0) involving resource leaks in the asus-wmi Linux kernel driver. The other two ASUS entries carry no severity rating and appear to be Linux kernel robustness fixes.
TP-Link and DD-WRT each had one CVE flagged. CVE-2025-56565 affects TP-Link TL-WR740N models (v1–v4) running DD-WRT firmware and involves cleartext storage of authentication credentials—a classic but dangerous flaw in legacy router firmware.
Recommendations
- Cisco users: Immediately check Cisco's latest security advisories for ISE, ASA, FTD, FMC, and Nexus Dashboard patches. Prioritize ISE and firewall appliances in air-gapped or DMZ deployments.
- Test before deploying: Given the volume and criticality, validate patches in a lab environment first.
- Monitor for exploitation: Enable enhanced logging on affected appliances and watch for suspicious API calls or administrative access anomalies.
- Legacy TP-Link devices: If you still operate TL-WR740N hardware running DD-WRT, consider retiring these devices or isolating them from sensitive network segments.
This is a week where patching delays translate directly to risk. Allocate resources accordingly.