# CISA adds Cisco IOS CSRF flaw to exploited catalog

Published: 2026-07-13 · Severity: high · Sectors: government-national, defense, infrastructure
Canonical: https://vorant.io/reports/eecfeebe-080d-5896-8edd-38e22c9cd555/cisa-adds-cisco-ios-csrf-flaw-to-exploited-catalog

> Cisco IOS cross-site request forgery vulnerability CVE-2008-4128 added to CISA's Known Exploited Vulnerabilities catalog due to active exploitation.

CISA has added CVE-2008-4128, a cross-site request forgery vulnerability in Cisco IOS, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CSRF vulnerabilities are a frequent attack vector used by malicious cyber actors and pose significant risks to enterprise environments. This vulnerability is listed as granting total control of affected devices post-exploitation.

Under CISA's Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are required to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets. CISA encourages all organizations, regardless of sector or agency status, to adopt risk-based vulnerability management and treat KEV Catalog entries as high-priority remediation targets. Organizations should verify whether systems were compromised before patching and implement appropriate containment measures.

## Mentioned in this report

- Vulnerabilities: CVE-2008-4128 (KEV)

## Detection guidance (public sample)

### Cisco IOS HTTP Server Privileged Command URL Requested via Web Proxy

ATT&CK: T1499.004

Detects web requests to the Cisco IOS HTTP exec/configure URL paths (/level/15/...), the interface abused in CVE-2008-4128 CSRF attacks to run privileged commands through an admin's browser. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco IOS HTTP Server Privileged Command URL Requested via Web Proxy
description: Detects proxied HTTP requests to the Cisco IOS HTTP server privileged
  command paths (/level/15/exec/ and /level/15/configure/). CVE-2008-4128 is a CSRF
  flaw in this interface, so a victim browser can be made to issue state-changing
  GET requests that run device commands. Rare in normal browsing; review the referrer
  and source user.
references:
- https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog
tags:
- attack.impact
- attack.t1499.004
- attack.lateral-movement
- attack.t1021
logsource:
  category: proxy
detection:
  selection_path:
    c-uri|contains:
    - /level/15/exec/
    - /level/15/configure/
    - /level/14/exec/
  selection_method:
    cs-method: GET
  condition: selection_path and selection_method
falsepositives:
- Network administrators managing Cisco IOS devices through the legacy web interface
  via a proxy
- Authorised vulnerability scanners probing IOS HTTP servers
level: medium
id: 7e6b4121-f58b-5f1d-82d4-a4b59198b315
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eecfeebe-080d-5896-8edd-38e22c9cd555/cisa-adds-cisco-ios-csrf-flaw-to-exploited-catalog.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup