What Changed
On July 13, 2026, CISA added one entry to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2008-4128, a cross-site request forgery (CSRF) vulnerability in Cisco IOS.
The CVE dates from 2008. It covers the HTTP administration component of Cisco IOS 12.4 and was originally reported on the Cisco 871 Integrated Services Router. A forged request can make a logged-in administrator’s browser run commands on the router, such as a “show privilege” command sent to /level/15/exec/- or an “alias exec” command sent to /level/15/exec/-/configure/http.
Why A 2008 Bug Is On The List
KEV entries are based on exploitation, not on age. The CSRF works only if an administrator with an active session on the router’s web interface visits an attacker’s page. Routers that still run IOS 12.4 with the HTTP server enabled are old devices that are often forgotten.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The KEV notes link to Cisco’s IOS 12.4 mainline release page in its obsolete-software section. In practice the fix is to disable the web interface or replace the device. CISA set a federal due date of July 16, 2026, and the entry is flagged for forensic triage under BOD 26-04.
What BOD 26-04 Asks For
BOD 26-04 requires federal civilian agencies to put KEV flaws on exposed assets that give total control first, and to check whether attackers got in before the fix. CISA encourages all organizations to use the KEV catalog the same way.
What To Verify First
- Search the network inventory for routers still running IOS 12.4, including branch and out-of-band devices.
- Turn off
ip http serverandip http secure-serverwhere the web interface is not needed, and keep management access on a dedicated network. - Review device configurations for unexpected
alias execentries or privilege changes, and plan to replace hardware that can no longer be updated.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog (July 13, 2026)
- CVE-2008-4128 record
- CISA Known Exploited Vulnerabilities Catalog
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
