CISA Known Exploited Vulnerabilities

nvd.nist.gov • July 15, 2026

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco IOS Vulnerability CVE-2008-4128 Under Active Exploitation CISA has warned of ongoing attacks exploiting the CVE-2008-4128 vulnerability in Cisco IOS 12.4, a cross-site request forgery flaw. This vulnerability, which has been known since 2008, allows attackers to execute arbitrary commands on affected routers. The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on July 13, 2026. Attackers, potentially linked to Russian state actors, are targeting poorly configured devices globally. The advisory emphasizes the need for IT managers to check for vulnerable devices and apply necessary updates or replacements. CISA has provided a protection guide detailing countermeasures against these attacks. The vulnerability affects Cisco's 871 Integrated Services Router and poses a medium risk (CVSS 4.3). Recent attacks have highlighted the ongoing threat posed by legacy vulnerabilities in critical infrastructure. Security professionals are urged to implement recommended security measures immediately. 5 sources 80

Extracted Entities

CISA Known Exploited Vulnerabilities

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)