CISA Adds Cisco IOS CSRF Flaw Enabling Arbitrary Command Execution to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2008-4128, a cross-site request forgery (CSRF) vulnerability affecting Cisco IOS, to its Known Exploited Vulnerabilities (KEV) Catalog.

The vulnerability was officially listed on July 13, 2026, with a remediation deadline of July 16, 2026, for Federal Civilian Executive Branch agencies.

Although this vulnerability dates back to 2008, CISA’s inclusion in the catalog confirms that it is currently being exploited and requires urgent attention from organizations operating affected Cisco IOS devices.

CISA Adds Cisco IOS CSRF Flaw

CVE-2008-4128 affects Cisco IOS version 12.412.412.4 and involves multiple CSRF vulnerabilities in the operating system’s web-based management interface.

An attacker may exploit this vulnerability by convincing an authenticated administrator to visit a specially crafted web page or a malicious link while logged in to a vulnerable Cisco device’s HTTP management interface.

Successful exploitation can cause the victim’s browser to send unauthorized administrative requests to the device.

Specifically, this vulnerability can allow attackers to execute arbitrary commands via crafted requests that invoke the “show privilege” command at the /level/15/exec/- URI. Another attack path involves a malicious alias exec command sent to the /level/15/exec/-/configure/http URI.

Because these endpoints operate at privilege level 15, successful exploitation may grant attackers full administrative control of an affected network device.

This could allow an attacker to alter device configurations, create command aliases, modify access controls, redirect traffic, disrupt routing operations, establish persistence, or use the compromised appliance as a pivot point within the targeted environment.

The flaw falls under the CWE-352 category: Cross-Site Request Forgery. CSRF attacks exploit the trust relationship between a web application and an authenticated user’s browser. In this case, administrators who use Cisco IOS web management may be at risk if they visit attacker-controlled content while their management session is active.

CISA has not determined whether CVE-2008-4128 has been used in ransomware campaigns. However, the active exploitation of a network infrastructure vulnerability should be treated as a high-priority incident-response issue, as routers and switches typically provide privileged visibility into and control over enterprise traffic.

CISA advised affected organizations to implement mitigations per Cisco’s vendor guidance and follow the requirements outlined in Binding Operational Directive 26-0426-04, which prioritizes remediation based on exploitation risk. Agencies must also assess their internet exposure and comply with CISA’s forensics triage requirements.

Organizations should promptly identify assets running Cisco IOS 12.412.412.4, determine whether HTTP or HTTPS management services are enabled, and eliminate any unnecessary external exposure.

Administrators are encouraged to turn off web-based management interfaces that are not operationally necessary, restrict management access to dedicated networks, enforce multi-factor authentication through supporting controls, and review device logs for any suspicious configuration changes or unexpected privileged commands.

Given the short remediation window and confirmed exploitation in the wild, security teams should prioritize patching, mitigating, and conducting forensic reviews of the affected Cisco network infrastructure.

Gain browser-level visibility to expose decrypted phishing pages, speed investigations, and cut credential theft costs -> Power your SOC with ANY.RUN