Cisco has issued urgent patches for a set of critical vulnerabilities affecting its Webex services platform. The update impacts core elements of Webex, including authentication and identity services.
While Cisco confirmed there is no evidence of active exploitation, the severity of the vulnerabilities has prompted the company to issue an urgent patch update for all Webex users.
"A successful exploit could allow an attacker to gain unauthorized access to legitimate Cisco Webex services,"
Cisco said in the update.
In this case, weaknesses in authentication workflows and backend services create opportunities for unauthorized access under the right conditions. Cisco also paired this announcement with a separate warning affecting its wireless infrastructure portfolio, signaling that the risks extend beyond collaboration software into broader enterprise networking environments.
Breaking Down the Vulnerabilities
The Webex-related issues center on four critical vulnerabilities, several of which carry severity scores close to the maximum on the CVSS scale.
These include flaws tied to single sign-on integration and remote code execution within Cisco’s Identity Services Engine.
The SSO vulnerability is particularly notable for enterprises relying on centralized identity providers. Under certain conditions, an attacker could submit a crafted authentication token to gain unauthorized access to Webex services. In practical terms, this could allow a bad actor to impersonate legitimate users and move across collaboration environments.
Meanwhile, the remote code execution flaws in Cisco ISE and ISE-PIC introduce a different class of risk. These vulnerabilities could enable attackers to execute arbitrary code on affected systems, potentially giving them deeper control over network access policies and identity management frameworks.
Alongside the Webex issues, Cisco disclosed a separate bug in its IOS XE software affecting wireless access points. The problem stems from a logging process that generates files that grow at a steady rate of roughly 5 MB per day. Over time, this consumes available storage and eventually prevents devices from downloading updates or service packs.
More than 230 access point models are impacted across several software versions, making this a broad infrastructure concern. The longer affected devices remain unpatched, the greater the likelihood of update failures due to insufficient disk space.
