1-minute read
What a defender needs to know
Cisco’s October 29 advisory lists License (Smart Software Manager) On-Prem among products affected by four high-severity Node.js vulnerabilities and names 10-202610 as its fixed release. Secure Workload and several other affected entries still await release numbers. Catalyst SD-WAN Manager, ISE, IOS variants, ASA, FMC and FTD remain under investigation; track Cisco’s status for each platform before assigning an upgrade.
One flaw, CVE-2026-111497, lets malformed Brotli input corrupt Node.js decoder memory when an application decompresses it. CVE-2026-105482 can send a DNS query for a shortened hostname after a NUL byte. CVE-2026-105483 and CVE-2026-106069 can make TLS certificate checks use the wrong kind of name or address. Cisco acknowledges public proof-of-concept code and says its PSIRT knows of no malicious use against Cisco products.
Match deployed License On-Prem installations and other affected products to Cisco’s advisory and their product bugs. Schedule the Cisco 10-202610 upgrade where applicable, then confirm the installed release. Follow product-specific bug updates for pending fixes; the Node.js project versions 22.23.4, 24.22.1 and 26.12.1 apply to separately managed Node.js deployments, while Cisco products require Cisco releases. Keep investigated platforms on a separate status list and recheck Cisco’s table before choosing an upgrade.