Affected Vendors This Week
- Cisco: 36 CVEs (18 Critical, 18 High)
- ASUS: 6 CVEs (2 Critical, 3 High, 1 Unrated)
- TP-Link: 4 CVEs (4 High)
This week saw a significant spike in router and network infrastructure vulnerabilities, with 46 new CVEs identified. Cisco dominates the advisory with 36 entries—a notably heavy week for enterprise networking equipment. The severity distribution is alarming: 18 critical vulnerabilities and 18 high-severity issues demand immediate attention from infrastructure teams.
Critical Cisco Vulnerabilities
Cisco issued an exceptionally large security update this week, with particular concern around NX-OS software vulnerabilities in data center and campus switching environments.
Perfect Score Vulnerability: CVE-2026-76482 carries a CVSS score of 10.0—a perfect vulnerability rating. This affects Cisco License On-Prem (formerly SSM On-Prem), a critical component for license management in enterprise deployments. The exact impact remains under embargo in some sources, but the maximum severity rating indicates remote unauthenticated code execution or equivalent is possible.
NX-OS OAM Feature Flaws: A cluster of critical vulnerabilities affects multiple Operation, Administration, and Maintenance (OAM) features in Cisco NX-OS:
- CVE-2026-76501 (CVSS 9.8): Segment Routing over IPv6 (SRv6) OAM allows unauthenticated remote attackers to execute arbitrary code
- CVE-2026-76485 and CVE-2026-76486 (CVSS 9.8 each): VXLAN OAM vulnerabilities enabling remote code execution
- CVE-2026-76465 (CVSS 9.8): MPLS OAM flaw affecting Nexus 3000 and 9000 Series Switches
NX-API Remote Code Execution: CVE-2026-76471 (CVSS 9.8) impacts the NX-API feature, allowing unauthenticated remote attackers to achieve root-level code execution or denial of service. This is particularly critical for organizations using NX-API for automation and orchestration.
APIC Controller Issues: CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500 (all CVSS 9.8) affect the Cisco Application Policy Infrastructure Controller, which manages application-centric networking policies across enterprise fabrics.
Action Required: Cisco users should immediately check for available patches on the Cisco Security Advisory pages. Prioritize updates for Nexus switches and APIC controllers in production environments, particularly those exposed to untrusted networks.
ASUS Router Threats
ASUS released six CVEs this week, including two critical issues in router modules that should concern small office and home office (SOHO) users and SMBs relying on ASUS networking equipment.
CVE-2026-14911 (CVSS 9.3): A cross-site scripting (XSS) vulnerability in ASUS router web interfaces allows remote attackers to read sensitive DOM content. While typically XSS flaws rate lower, the "9.3" severity suggests broad exploitation potential or access to highly sensitive data.
CVE-2026-19386 (CVSS 9.3): A stack-based buffer overflow in ASUS router modules permits authenticated nearby users to execute arbitrary code. The "nearby user" constraint suggests this may require proximity (Bluetooth, local Wi-Fi) but should not be underestimated.
CVE-2026-16528 (CVSS 8.4): Sensitive information insertion into log files allows authenticated remote attackers to harvest DDNS credentials—a foothold for persistent network access.
CVE-2026-19396 (CVSS 7.7): The ASUS RT-BE57 uses a predictable seed for IFTTT pairing token generation, allowing attackers to forge authentication tokens without credentials.
Action Required: ASUS users should update router firmware immediately through the ASUS support portal. Check device logs for unauthorized access attempts, especially if DDNS or IFTTT integration is enabled.
TP-Link Camera and Device Vulnerabilities
TP-Link's Tapo camera line and TDP protocol implementations contain four high-severity flaws centered on authentication and protocol design:
CVE-2026-105672 and CVE-2026-105674 (CVSS 8.7 each): The Tapo C325WB V2 suffers from unauthenticated API access and weak pre-shared key generation via time-seeded PRNG. Attackers can bypass authentication or predict streaming service credentials.
CVE-2026-104944 and CVE-2026-104945 (CVSS 7.1 and 6.8): The Tapo C500 v2.0 contains out-of-bounds function-pointer dispatch and stack write vulnerabilities in its TDP daemon and ONVIF PTZ handlers, enabling code execution.
Action Required: Update Tapo devices through the Tapo mobile app or web interface. Review camera network segmentation and consider disabling unnecessary protocols (ONVIF, local streaming) if not in use.
Week Summary
This week represents a critical advisory cycle, with Cisco's NX-OS platform bearing the brunt of disclosed vulnerabilities. Enterprise teams managing data center switching, campus networks, and policy controllers should treat this as high priority. Simultaneously, SOHO and SMB users should update ASUS and TP-Link devices to mitigate active exploitation risks. Monitor vendor security pages throughout the week for patches and workarounds.
```