---
id: "CVE-2018-0147"
kind: "vulnerability"
aliases: ["CVE-2018-0147"]
title: "Cisco Secure Access Control System (ACS): Cisco Secure Access Control System Java Deserialization Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.18212
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Secure Access Control System (ACS)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acs", "cisco", "exploited", "infrastructure", "network-appliance"]
not_affected_if: ["acs-not-deployed"]
published_at: "2018-03-08T07:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0147", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-0147", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0147", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco Secure Access Control System (ACS): Cisco Secure Access Control System Java Deserialization Vulnerability

Cisco Secure Access Control System (ACS) unsafely deserializes Java objects supplied by users. An unauthenticated remote attacker can run arbitrary commands on the affected device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Secure Access Control System (ACS) affected ? fixed ?

## How to check

Identify ACS appliances or instances in use and compare their version against the Cisco advisory. unknown

## Fix

Apply the update per Cisco's vendor instructions; CISA requires updates per vendor instructions. unknown

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-0147
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-0147
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-0147

## From the sources

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_