Cisco Pre-Announces Security Advisories for Nine Product Families on August 19
Cisco Systems has published an advance notification stating that it will release security advisories for multiple products on August 19, 2026. The company informed customers on August 12 that nine product families will be covered by the upcoming advisories.
The pre-notification does not include specific CVE identifiers, vulnerability details, severity scores, or affected versions. Cisco instead urges all users of the listed products to apply the corrective updates as soon as they are published.
The nine product groups covered by the planned advisories are:
- BroadWorks
- Industrial Ethernet 1000 Series Switches
- Packaged Contact Center Enterprise and Unified Contact Center Enterprise
- RoomOS
- Secure Firewall Adaptive Security Appliance
- Secure Firewall Management Center
- Secure Firewall Threat Defense
- Secure Workload
- Unified Intelligence Center
Security professionals are encouraged to review the forthcoming advisories promptly and schedule the recommended updates to reduce exposure to potential vulnerabilities.
Related articles
Nginx Leaves Dynamic Tables Unused in HTTP/2 and HTTP/3 Responses
Nginx implements one-way header compression for both HTTP/2 and HTTP/3: clients compress repeated headers using HPACK or QPACK dynamic tables, but the server never writes to its own dynamic table when sending responses. Code analysis of release-1.31.3 shows every call to ngx_http_v3_encode_field_ri and ngx_http_v3_encode_field_lri passes dynamic=0, and the server encoder stream (NGX_HTTP_V3_STREAM_SERVER_ENCODER) is never created. The same pattern exists in the HPACK filter module, which explicitly sends a table-size update of zero and never calls ngx_http_v2_hpack_t structures. The receiving side fully supports dynamic tables up to the default 4096-byte limit and correctly processes insertions from clients such as aioquic. This asymmetry is permitted by RFC 9204 §4.2 yet removes the compression benefit the binary protocols were designed to provide. The unused encoder path contributed to a use-after-free vulnerability (CVSS 9.2) discovered earlier this year in the QPACK decoder.
JetBrains TeamCity CVE-2026-63077 Actively Exploited in the Wild, JPCERT Urges Immediate Patching and Breach Investigation
A critical deserialization vulnerability tracked as CVE-2026-63077 has been discovered in JetBrains TeamCity, allowing unauthenticated remote code execution through the agent polling protocol. The flaw was privately reported to JetBrains on July 10, 2026, and publicly disclosed on July 27 with patches released in TeamCity 2026.1.3 and 2025.11.7. Following disclosure, active exploitation was confirmed, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities Catalog on August 5 and mandate federal agencies to remediate by August 8. JetBrains issued its own exploitation warning on August 7. JPCERT/CC has verified that affected versions remain in use within Japan and notes that public exploit code is now available, recommending organizations verify their deployments, apply updates promptly, and conduct compromise assessments.
Attackers Actively Exploit Critical SharePoint Authentication Bypass CVE-2026-55040 After Public PoC Release
Active exploitation of CVE-2026-55040, a critical authentication bypass vulnerability in Microsoft SharePoint Server, has intensified following the public release of a proof-of-concept exploit. The flaw, which carries a CVSS score of 9.1, stems from multiple defects in the JWT token validation pipeline and allows remote attackers to impersonate any user, including administrators, without valid credentials. Affected versions include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, with heightened risk for instances exposed to the internet. Microsoft released patches in July 2026, and organizations are urged to apply them immediately while restricting external access and monitoring IIS logs for anomalous administrative activity. The vulnerability has already been chained with other flaws in real-world incidents involving persistence, data theft, and credential rotation responses.
Microsoft Patches High-Severity Outlook Flaw Allowing Remote Code Execution
Microsoft has addressed a high-severity vulnerability in Outlook tracked as CVE-2026-70329 with a CVSS score of 8.8. The flaw stems from an integer overflow during data processing that can trigger memory corruption and alter the application's execution flow. Exploitation occurs over the network without requiring authentication or privileges, though some user interaction is necessary to process the malicious content. Successful attacks grant code execution under the privileges of the logged-in user, potentially enabling malware installation, file access, data theft, or lateral movement. The issue impacts Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Outlook 2016 on both 32-bit and 64-bit systems. A dedicated patch KB5002755 updates Outlook 2016 to build 16.0.5565.1000, while Click-to-Run versions receive fixes through standard Microsoft update channels.