Multiple vulnerabilities in Cisco products (July 2, 2026)
Multiple vulnerabilities have been discovered in Cisco products. They allow an attacker to cause a remote denial of service and a breach of data confidentiality.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to cause a remote denial of service and a breach of data confidentiality.
- Who is affected
- Users of affected Cisco products.
- Urgency
- Remediation is urgent due to the potential for remote denial of service and data confidentiality breaches, with unknown exploitation status.
- Action
- Upgrade to the fixed software as indicated in the advisories.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0825/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-202160.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202430.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202150.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202130.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202140.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202170.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-202440.57% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-201910.91% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20216 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20243 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20215 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20213 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20214 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20217 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20244 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-20191 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [medium] ClamAV: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
- highCVE-2026-20244: ClamAV DMG File Processing Denial of Service Vulnerabilitymsrc
- highCVE-2026-20214: ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerabilitymsrc
- highCVE-2026-20213: ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerabilitymsrc
- highCVE-2026-20217: ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerabilitymsrc
- highCVE-2026-20216: ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerabilitymsrc
- highCVE-2026-20243: ClamAV ALZ Archive Processing Denial of Service Vulnerabilitymsrc
- highCVE-2026-20215: ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerabilitymsrc
- unknownUSN-8517-1: ClamAV vulnerabilitiesubuntu
- highCisco Catalyst Center Arbitrary File Read Vulnerabilitycisco-psirt
- medium[UPDATE] [medium] Cisco Catalyst Center: Vulnerability Allows Information Disclosurecert-bund
Recent advisories for Cisco products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownMultiple vulnerabilities in Cisco products (20 August 2026)cert-fr-avis · 2026-08-20
- criticalCVE-2026-20359: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cro…nvd · 2026-08-19
- criticalCVE-2026-20358: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cro…nvd · 2026-08-19
- criticalCVE-2026-20357: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Cro…nvd · 2026-08-19
- highCVE-2026-20319: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Sec…nvd · 2026-08-19
- criticalCVE-2026-20318: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Sec…nvd · 2026-08-19
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21