Cisco Secure Access Control System Java Deserialization Vulnerability
- Severity
- Critical9.8CVSS 3.1, Critical
- EPSS
- 18%
- Published
- 8 Mar 2018
- Updated
- 17 Jun 2026
Description
Title, description and vendor guidance are quoted from the source records.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.
Weakness: CWE-20, CWE-502
Known exploited
Added to CISA KEV on 25 Mar 2022
Federal remediation due date: 15 Apr 2022
Required action: Apply updates per vendor instructions.
Exploit prediction
18% probability of exploitation in the next 30 days (percentile 97%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Patcharo shows this vulnerability for information but does not match versions for this product yet.
- n/a Cisco Secure Access Control System · Cisco Secure Access Control System
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Cisco (CVE record)
- Cisco (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- CISA Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities · 27 Sept 2026, 23:42 UTC · Parser patcharo-kev/1.0.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC