Alert GCSA-26066 - Vulnerabilita' critiche in prodotti Cisco

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26066
       data: 16 aprile 2026
     titolo: Vulnerabilita' critiche in prodotti Cisco

******************************************************************

:: Descrizione del problema

   Cisco ha pubblicato alcuni avvisi di sicurezza, con i quali vengono risolte
   15 vulnerabilita', delle quali 4 di livello critico, relative ai prodotti
   Webex Meetings, Identity Services Engine (ISE) e ISE Passive Identity Connector (ISE-PIC).

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Apparati interessati

   Cisco ISE (Identity Services Engine)
   Cisco ISE-PIC (ISE Passive Identity Connector)
   Cisco Webex
   Cisco Secure Web Appliance
   Cisco Unity Connection
   Cisco ThousandEyes Enterprise Agent

   Per una descrizione completa dei dispositivi interessati, si prega di fare riferimento
   ai Security Advisories ufficiali.


:: Impatto

   Esecuzione remota di codice arbitrario (RCE)
   Cross Site Scripting (XSS)
   Bypass delle funzionalita' di sicurezza (SFB)
   Denial of Service (DoS)
   Spoofing (Provide Misleading Information)


:: Soluzioni

   Si consiglia di valutare l'impatto delle vulnerabilita' sui dispositivi in uso,
   e di aggiornare il prima possibile.

   E' possibile utilizzare Cisco Software Checker
   https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
   per determinare il patching appropriato.

   Prima dell'installazione del software consultare il sito del fornitore per maggiori dettagli.


:: Riferimenti

   Cisco Security Advisories
   https://sec.cloudapps.cisco.com/security/center/publicationListing.x

   Cisco Identity Services Engine (ISE)
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-5WSJcYJB
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-traversal-8bYndVrZ

   Cisco Unity Connection
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-vulns-n2EJSbbw

   Cisco Webex Contact Center
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webexcc-xss-WEX5nUnA

   Cisco Webex Services
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL

   Cisco Secure Web Appliance
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-auth-bypass-6YZkTQhd

   Cisco ThousandEyes Enterprise Agent
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-agentfilewrite-tqUw3SMU

   Bleeping Computer
   https://www.bleepingcomputer.com/news/security/cisco-says-critical-webex-services-flaw-requires-customer-action/

   SecurityWeek
   https://www.securityweek.com/cisco-patches-critical-vulnerabilities-in-webex-ise/

   The Hacker News
   https://thehackernews.com/2026/04/cisco-patches-four-critical-identity.html

   Mitre CVE
   I riferimenti CVE sono disponibili negli advisory del produttore.


GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaeEOiAAKCRDBnEyTZRJg
QqqpAKDGw98bFTT5shGsY5n2eGGvDlqZuwCgquzrpfwMBZOFdUhchddLrF8VP8w=
=VvB0
-----END PGP SIGNATURE-----