Cisco Pre-Announces Security Advisories and Patches for Multiple Products on September 2, 2026
Cisco Systems has revealed that it will publish multiple security advisories on September 2, 2026, covering a range of its products. The company issued a pre-notification on August 26, 2026, indicating that updates addressing vulnerabilities will be released alongside the advisories.
The affected products include Cisco IOS XR Software, the Cisco Desk Phone 9800, 8800, 7800, and 8875 series, Nexus 9000 Series switches equipped with Silicon One, and Cisco Secure Email. For IOS XR, Cisco plans to deliver updates specifically intended to enhance overall security posture.
At this pre-notification stage, the company has not disclosed CVE numbers, technical details of the vulnerabilities, affected versions, CVSS base scores, or severity ratings. No information has been provided regarding active exploitation or proof-of-concept code.
Cisco intends to publish individual advisories for each product that will include remediation guidance. The vendor continues to strongly recommend that customers apply the updates as soon as they are available. The pre-notification remains subject to change, and additional products may be added or removed from the list before the final publication date.
Related articles
CISA Adds Six Known Exploited Vulnerabilities Affecting NetScaler ADC, Linux Kernel and Microsoft SQL Server to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added six vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. One of the flaws, CVE-2026-8452, affects Citrix NetScaler ADC and NetScaler Gateway products and can trigger denial-of-service conditions under specific configurations. The remaining five issues, disclosed between 2015 and 2022, impact the Linux Kernel, Red Hat Automatic Bug Reporting Tool, and the libuser library. Exploitation of these older flaws can allow local attackers to escalate privileges or corrupt password files. Organizations are urged to apply available patches and verify configurations immediately.
Zscaler Fixes Multiple Critical Flaws in Client Connector Enabling RCE and Authentication Bypass
Zscaler has released patches for several vulnerabilities in its Client Connector agent that could lead to remote code execution, authentication bypass, local privilege escalation, and denial of service. The most severe issue, tracked as CVE-2026-59568 with a CVSS score of 9.1, allows unauthenticated remote attackers to execute arbitrary code within the context of the Zscaler Client Connector process. A second critical flaw, CVE-2026-59564 also rated CVSS 9.1, affects communication between the connector and its management portal, enabling attackers to circumvent authentication mechanisms. Additional vulnerabilities include a local buffer overflow on Android and ChromeOS tracked as CVE-2026-59566 with CVSS 8.4, as well as issues that could result in privilege escalation or service disruption. The flaws impact Client Connector versions across Windows, macOS, Linux, iOS, Android, and ChromeOS, with varying affected builds depending on the platform. Updated builds for lines 4.6 through 4.9 on Windows and equivalent fixes for other operating systems are now available.
Out of 48,000 Vulnerabilities Only 1% Are Dangerous: How to Find Them Using CVSS 4.0, EPSS, KEV and FSTEC Methodology
The article explains why prioritizing vulnerabilities is critical in 2025-2026 as exploitation became the top initial access vector for the first time in 19 years according to Verizon DBIR. It details the limitations of CVSS scoring alone, the shift to CVSS 4.0 with new metrics like Attack Requirements and Supplemental Metrics, and the impact of NIST reducing NVD enrichment to only actively exploited or federal software cases. EPSS provides daily exploitation probability predictions using machine learning on over 1,100 features, while CISA KEV and the new LEV metric help identify confirmed or likely exploited vulnerabilities. The text covers practical prioritization criteria including asset significance, exploit availability, and network exposure, plus challenges for Russian infrastructure due to CVE dependency. It also compares CISA KEV with commercial catalogs like VulnCheck KEV that detect exploitation earlier.
Google Releases Chrome 152 Fixing 327 Vulnerabilities Including 10 Critical Flaws
Google has released Chrome 152 for Windows, macOS, and Linux, addressing a total of 327 security vulnerabilities. Ten of these issues received the highest severity rating of Critical. The update resolves multiple Use After Free flaws in core components such as ANGLE, Aura, and Chromecast. Specific CVEs fixed include CVE-2026-79282 in ANGLE and several others in Aura and Chromecast modules. The release targets memory corruption and input validation weaknesses that could lead to remote code execution. Users are strongly advised to apply the update immediately to mitigate potential exploitation risks.