SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76484

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76484 are related to issues with insufficient protection against code injection that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-94.

Erkennung & Indikatoren

Ausnutzung

These vulnerabilities were found during internal testing and are not known to be actively exploited.

Behobene Versionen

  • 10-202609

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("java.exe", "tomcat.exe")
| where ProcessCommandLine contains "-D" and ProcessCommandLine contains "=" and ProcessCommandLine contains "exec" // Example for code injection via command line arguments
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=linux_audit EventCode=EXECVE)
| where (CommandLine LIKE "%-D%" AND CommandLine LIKE "%=" AND CommandLine LIKE "%exec%")
| stats count by _time, host, CommandLine, Image

Sigma

title: Cisco License On-Prem Code Injection Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\java.exe'
    CommandLine|contains:
      - '-D'
      - '='
      - 'exec'
  condition: selection
falsepositives:
  - Legitimate software updates or installations
level: high

Elastic ES|QL

from process where process.parent.executable in ("java.exe", "tomcat.exe") and process.command_line : ("-D*=*", "*exec*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen