Cisco Issues Security Updates for IOS XR Fixing Multiple Critical Vulnerabilities
Cisco Systems has published security updates for its network operating system Cisco IOS XR to remediate multiple vulnerabilities identified through internal investigation.
The updates were released on September 2, 2026, local time. Researchers classified the issues into seven categories and assigned individual CVE identifiers to each. All releases are affected regardless of specific configuration settings.
Critical Vulnerabilities
CVE-2026-20274 stems from improper resource management, leading to buffer overflows and out-of-bounds memory read/write operations. CVE-2026-20279 involves access control deficiencies. Both received a CVSS v3.1 base score of 9.8 and are rated Critical.
High-Severity Issues
- CVE-2026-20278, CVE-2026-20275, and CVE-2026-20280 address command injection and related problems with a base score of 8.8.
- CVE-2026-20276 concerns control flow management weaknesses, scoring 8.6.
- CVE-2026-20277 involves protection mechanism failures, rated 8.2.
No evidence of active exploitation was reported at the time of the advisory. Cisco has made available Software Maintenance Updates (SMU) and intends to incorporate the fixes into future versions 26.3.1 and 26.2.2.
Related articles
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.
F5 BIG-IP APM Vulnerability CVE-2026-94127 Allows Remote Code Execution, Already Exploited in the Wild
F5 has disclosed a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager that is already being actively exploited. The flaw, tracked as CVE-2026-94127, affects systems configured as an OAuth authorization server with both an access policy and OAuth profile applied to a virtual server. Successful exploitation can result in arbitrary code execution from crafted network traffic. The issue also impacts appliance mode configurations. F5 rates the vulnerability 9.3 under CVSS v4.0 and 9.8 under CVSS v3.1, classifying it as Critical. The company discovered the flaw internally and has confirmed real-world exploitation, urging immediate patching and compromise assessment.
ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been announced, featuring three tracks, four stages, and over 30 speakers focused on advanced offensive techniques, vulnerability discovery, and secure development practices. The event will take place on September 30, 2026, in Saint Petersburg at LOFT#7. Key presentations on the Offensive Track cover femtocell security, mobile operator advertising API exploitation, Trusting Trust attacks on the JDK, Rust memory safety limitations, and AMD SMM vulnerabilities including CVE-2025-54502. Additional talks examine Qualcomm BootROM flaws such as CVE-2026-25262, Linux kernel exploitation via CVE-2026-31695, Semtech LR11xx chip vulnerabilities, and reverse engineering of Dexprotector. The program emphasizes practical research into binary exploitation, side-channel analysis, and cross-chain bridge attacks.
BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has released BigDiskBuster, a new exploit targeting Microsoft Defender that prevents the platform and antivirus signatures from receiving updates. The tool leaves Windows systems protected only by an outdated threat database while the interface continues to display normal status indicators. BigDiskBuster works across all currently supported Windows versions but requires continuous background execution. The researcher has published the source code on GitHub and acknowledged that the current implementation contains bugs requiring further refinement. The technique closely resembles the earlier UnDefend tool released in April, which similarly interfered with Defender update mechanisms. Naseri has disclosed nearly a dozen proof-of-concept exploits since April affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and Plasma variants. Microsoft has not yet issued a patch for BigDiskBuster and previously criticized uncoordinated public disclosures of working exploits.