Cisco warns of IOS XE zero-day actively exploited in attacks

Cisco has discovered a vulnerability in the web UI feature of Cisco IOS XE Software. This vulnerability allows remote attackers to create an account with high privileges on an affected system. They can then use this account to take control of the system.

For steps to close the attack vector for this vulnerability, see the recommendations section of this advisory. Cisco will provide updates on the status of this investigation and when a software patch is available.

• Alert

Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day

By infosecbulletin / Wednesday , November 11 2026

Microsoft has shared its updates for November 2026. These updates fix 1,093 new flaws in Windows, Office, SQL Server, SharePoint,...

Read More

• Alert

Barracuda ESG flaws exploited, gaining root access

By infosecbulletin / Wednesday , November 11 2026

Barracuda has confirmed active exploitation of security flaws affecting its Email Security Gateway (ESG), warning that attackers could combine two...

Read More

• Alert

Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems

By infosecbulletin / Tuesday , November 10 2026

Apple, SAP, and Ivanti have published security updates that fix several flaws with messaging, Bluetooth, enterprise servers, and endpoint management...

Read More

• Hot Topic

Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom

By infosecbulletin / Tuesday , November 10 2026

A jailbroken AI has been attacking a European telecom company and 13 companies using its data center and cloud for...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 10.11. 2026

By infosecbulletin / Tuesday , November 10 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

IBM fixes 208 API Connect vulnerabilities, 47 critical

By infosecbulletin / Tuesday , November 10 2026

IBM patched 208 security flaws in its API Connect platform. The CVE records released out on November 7, 2026. Among...

Read More

• Ransomware

89 New ransomware groups emerge in 2026, claiming over 2,200 victims

By infosecbulletin / Sunday , November 8 2026

New ransomware actions in 2026 show more variety in cybercrime, with some groups claimed over 100 victims. The ransomware attack...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 08.11. 2026

By infosecbulletin / Sunday , November 8 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction

By infosecbulletin / Saturday , November 7 2026

A major system failure has brought customer-facing banking services to a standstill at 128 shinkin banks across western Japan, leaving...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 06.11. 2026

By infosecbulletin / Friday , November 6 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

Affected Products Vulnerable Products

This vulnerability affects Cisco IOS XE Software if the web UI feature is enabled. The web UI feature is enabled through the ip http server or ip http secure-server commands.

To read the full report click here