What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured urgency.
CISA added CVE-2026-76504 (Cisco Catalyst SD-WAN Manager) to its Known Exploited Vulnerabilities catalog on September 30, 2026, which means there is reliable evidence of exploitation in the wild. Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI…
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Catalyst SD-WAN Manager systems are exposed to active attacks now.
Treat this as an emergency.
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts.
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.
CISA added CVE-2026-76460 (Cisco Identity Services Engine) to its Known Exploited Vulnerabilities catalog on September 16, 2026, which means there is reliable evidence of exploitation in the wild. Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized…
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Identity Services Engine systems are exposed to active attacks now.
Treat this as an emergency.
The latest developments from the last 30 days, newest first.
The Fine Art of Frustrating the Adversary
Basis: Cisco Talos Intelligence (security research)
Cisco warns of new SD-WAN zero-day exploited in attacks
Basis: Reporting by BleepingComputer
CVE-2026-76504 added to CISA KEV: Cisco Catalyst SD-WAN Manager, Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Basis: CISA Known Exploited Vulnerabilities catalog
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Basis: Cisco Talos Intelligence (security research)
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Identity Services Engine
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Secure Email Gateway
Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Cisco Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Cisco IOS
Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco Unified Communications Manager
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Cisco Catalyst SD-WAN
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Cisco Catalyst SD-WAN Manger
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Cisco Secure Firewall Management Center (FMC)
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
Cisco Catalyst SD-WAN Controller and Manager
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Cisco SD-WAN
Cisco SD-WAN Path Traversal Vulnerability
Cisco Unified Communications Manager
Cisco Unified Communications Products Code Injection Vulnerability
Cisco Multiple Products
Cisco Multiple Products Improper Input Validation Vulnerability
Cisco IOS and IOS XE
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability
