CISA adds actively exploited Cisco IOS flaw to its must-patch catalog

CISA has added a Cisco IOS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real attacks, requiring federal agencies to patch it under a binding deadline. Cisco IOS and IOS XE run the routers and switches behind many enterprise and service-provider networks, so a flaw here can give attackers a foothold deep in the network path. The listing lands amid heightened warnings, including a joint US-and-allies advisory this week urging better router hygiene against Russian state-sponsored targeting of network devices. Network gear is attractive because it often sits unmonitored, stays online for years, and rarely runs endpoint security; timely patching is the main defense.

Check

Identify Cisco IOS and IOS XE devices, check them against Cisco's advisory for the newly listed flaw, and prioritize patching internet-facing and edge devices while reviewing configurations and logs for tampering.

Affected

Organizations running affected Cisco IOS or IOS XE network devices, especially internet-facing routers and switches; active exploitation means unpatched devices are at real risk of compromise deep in the network path.

Fix

Apply Cisco's fixed software promptly, restrict and monitor management interfaces, follow current router-hygiene guidance against state-sponsored targeting, and inspect device configurations and logs for signs of unauthorized changes.