Live › vulnerability › CVE-2018-0147
Go to dashboardCisco Secure Access Control System (ACS) unsafely deserializes Java objects supplied by users. An unauthenticated remote attacker can run arbitrary commands on the affected device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Secure Access Control System (ACS) | vendor | – | – |
Identify ACS appliances or instances in use and compare their version against the Cisco advisory. unknown
Apply the update per Cisco's vendor instructions; CISA requires updates per vendor instructions. unknown
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.
This page as .md · .json · in your agent: get_signal("CVE-2018-0147")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.