CISA flags Cisco, Chrome, Arista flaws under attack
CISA added three actively exploited vulnerabilities to its KEV catalog: Cisco SD-WAN command injection, Chrome V8 memory corruption, and an Arista EOS tunnel decapsulation flaw with no patch planned.
The U.S. Cybersecurity and Infrastructure Security Agency has identified three vulnerabilities under active exploitation, requiring Federal Civilian Executive Branch agencies to remediate by June 23, 2026. The flaws span critical network infrastructure and browser technologies.
CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager, allowing authenticated local attackers to execute arbitrary commands as root through a crafted file. CVE-2026-11645 is an out-of-bounds read/write vulnerability in Google Chrome's V8 JavaScript engine, enabling remote code execution within the browser sandbox via malicious HTML. CVE-2026-7473 impacts Arista Extensible Operating System on 7020R, 7280R/R2, and 7500R/R2 series devices configured as tunnel endpoints, allowing unexpected decapsulation and forwarding of non-configured tunnel traffic due to insufficient protocol type verification.
Arista has declined to issue patches for CVE-2026-7473, citing risks to existing deployments, instead recommending ACL-based mitigations on affected devices or upstream equipment to filter tunnel traffic. Comcast researchers responsibly disclosed the Arista vulnerability after observing active exploitation in the wild.
Mentioned in this report
Detection guidance
Suspicious Interpreter Spawned by Chrome Renderer/Browser Process
Detects a scripting or command interpreter process spawned directly from chrome.exe, consistent with post-exploitation execution following a V8 engine sandbox-escape/RCE such as CVE-2026-11645. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Interpreter Spawned by Chrome Renderer/Browser Process
id: e7c7ef69-351c-5e76-a44c-bda33844173b
status: experimental
description: Detects command or scripting interpreters launched as a child process
of Google Chrome, which can indicate exploitation of a browser vulnerability (e.g.
V8 engine memory corruption) leading to code execution outside the sandbox.
references:
- CVE-2026-11645
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\chrome.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\mshta.exe
- \\rundll32.exe
- \\regsvr32.exe
filter:
Image|endswith:
- \\chrome.exe
- \\GoogleUpdate.exe
condition: selection and not filter
falsepositives:
- Enterprise browser extensions or native messaging hosts that legitimately invoke
helper scripts
- Chrome-based kiosk or automation frameworks (e.g. Selenium) that spawn interpreters
for legitimate automation
level: high
tags:
- attack.t1203
- attack.t1059
author: Vorant
Root Shell Spawned by Cisco SD-WAN Manager (vManage) Service Process
Detects a shell interpreter spawned as root from the Cisco Catalyst SD-WAN Manager (vmanage) service process tree, consistent with exploitation of CVE-2026-20245 where a crafted file triggers arbitrary command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root Shell Spawned by Cisco SD-WAN Manager (vManage) Service Process
id: 0e59d69e-6ac1-5814-acc8-6baef0f3c713
status: experimental
description: Detects a command shell (bash/sh/dash) executed as root with a parent
process belonging to the Cisco Catalyst SD-WAN Manager (vmanage) service, which
may indicate exploitation of CVE-2026-20245 via a crafted file processed by the
manager application.
references:
- CVE-2026-20245
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: vmanage
Image:
- /bin/bash
- /bin/sh
- /bin/dash
User: root
filter:
CommandLine|contains:
- logrotate
- backup
- cron
condition: selection and not filter
falsepositives:
- Legitimate scheduled maintenance or backup scripts executed by the vmanage service
account
- Vendor-supplied administrative tooling that intentionally shells out from the management
application
level: high
tags:
- attack.t1059
- attack.t1203
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free