# CISA Adds Cisco IOS Vulnerability to Exploited Flaws Catalog Federal agencies ordered to patch the flaw by July 13, 2026. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/843425e1-ec51-48aa-a6af-2eeafb91d04d ## CISA's Critical Move The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Cisco IOS vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2008-4128, this flaw particularly affects Cisco 871 Integrated Services Routers running IOS 12.4. ## Technical Details of the Flaw Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in the HTTP Administration interface of Cisco IOS 12.4. Attackers can trick authenticated administrators into executing privileged commands, potentially compromising device security. ## Potential Impacts This vulnerability allows remote execution of administrative commands. Attackers could modify router configurations, redirect network traffic, or completely take over devices. The flaw could have severe consequences for critical infrastructure operators. ## Federal Mandate Under Binding Operational Directive 22-01, CISA requires federal agencies to patch this vulnerability by July 13, 2026. Private sector organizations are also advised to review the catalog and implement similar protective measures. ## Cisco's Stance The company hasn't released a patch yet but recommends disabling the HTTP Administration interface as a temporary workaround. Security experts question why this 15-year-old vulnerability was only now added to the catalog. ## Cybersecurity Warning Experts emphasize that critical infrastructure operators must address this vulnerability immediately. While CSRF attacks may seem simple, they can completely compromise network security and lead to significant data breaches. ## Sources covering this story - https://securityaffairs.com/195262/security/u-s-cisa-adds-a-cisco-ios-flaw-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._