Overview
Cisco
Cisco has released a security advisory regarding a recent actively exploited high-severity vulnerability impacting their Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defence (FTD) Software. If successfully exploited, this vulnerability could allow a remote attacker to cause a denial of service (DoS) condition by triggering unexpected software reloads.
- CVE-2026-76418 – Unchecked Return Value to NULL Pointer Dereference Vulnerability – CVSSv3.1 Score: 8.6
Affected Versions:
|
Cisco Secure FTD Software Release |
First Fixed Release |
Cisco Secure Firewall ASA Software Release |
First Fixed Release |
|
7.0 and earlier |
7.0.11 |
9.16 and earlier |
9.16.4.104 |
|
7.2 |
7.2.13 |
9.18 |
9.18.4.96 |
|
7.4 |
7.4.9 |
9.20 |
9.20.4.50 |
|
7.6 |
7.6.7 |
9.22 |
9.22.3.200 |
|
7.7 |
7.7.14 |
9.23 |
9.23.1.48 |
|
10.0 |
10.0.3 |
9.24
|
9.24.1.27 9.24.10.1 |
|
10.1 |
10.1.1 |
WordPress
WordPress has released a security update addressing multiple vulnerabilities in WordPress Core. At the time of writing, CVE identifiers had not yet been assigned to these vulnerabilities. One of the vulnerabilities affects the WordPress upgrade process and could potentially allow remote code execution (RCE) during software updates. Additional vulnerabilities addressed within the update include cross-site scripting (XSS) , a stored DoS vulnerability, and information disclosure and authorisation issues.
Affected Versions:
- All versions of WordPress Core prior to version 7.1.4.
Ivanti
Ivanti has released a security advisory addressing three vulnerabilities affecting its Ivanti Connect Secure (ICS) product, including two high severity vulnerabilities and one medium severity vulnerability. These vulnerabilities have been observed being exploited together as part of an exploitation chain.
- CVE-2026-104935 – Authentication Bypass by Spoofing Vulnerability – CVSSv3.1 Score: 8.6
- CVE-2026-111357 – Privilege Escalation Vulnerability – CVSSv3.1 Score: 7.0
- CVE-2026-118527 – Generation of Predictable Numbers Vulnerability – No listed CVSS Score yet.
Affected Versions:
- Ivanti Connect Secure 25.1.1.2 and prior; patched in version 25.1.1.3.
- Ivanti Connect Secure 25.1.2.2 and prior; patched in version 25.1.3.0 or 25.1.3.1.
- Ivanti Connect Secure 22.8R2.5 and prior; patched in version 22.8R2.6.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Cisco: Cisco Security Advisory
WordPress: WordPress Security Release
Ivanti: Ivanti Security Advisory