Cisco Security Advisories

Affected Environment
Cisco Secure Workload, Crosswork, BroadWorks, Packaged and Unified Contact Center Enterprise, RoomOS, IE 1000 switches and Unified Intelligence Center.

Threat Overview
Multiple vulnerabilities allow access control bypass, XML external entity injection, SQL injection, server-side request forgery, stored XSS and buffer overflow.

Exposure Timeline
Disclosed 19 August 2026 through Cisco's internal security hardening reviews, with fixed releases available across all affected product lines.

Attack Surface
Management interfaces, OCI-P provisioning services, HTTP request handlers, USB drivers and web-based configuration pages across Cisco product lines.

Technical Root Cause
Command and SQL injection, improper access control, external control of file system, insufficiently protected credentials and memory buffer flaws.

Exploitation Pathway
Attackers send crafted XML, HTTP or USB payloads to bypass authentication, execute arbitrary code or read internal database contents.