Notifications
Clear all
Topic starter
20/08/2026 5:59 pm
TL;DR: Microsoft's October 2025 Patch Tuesday delivered 175 CVEs, including six zero-days, while Expel highlighted Cisco IOS CVE-2025-20352 as a credential-gated zero-day that can lead to denial of service or root-level code execution once valid access is obtained. The key lesson is that patching alone is not enough when network devices accept compromised credentials as an authentication boundary.
NHIMG editorial — based on content published by Expel: October Patch Tuesday and the Cisco IOS zero-day
By the numbers:
- Microsoft released 175 new CVEs this month, eight of which are marked as critical.
- There are 39 different applications impacted by Windows Remote Access Connection Manager elevation of privilege issues.
- Cisco has 45 IOS vulnerabilities in CISA’s KEV catalog, alongside 81 total Cisco-related CVEs.
Questions worth separating out
Q: What breaks when attackers find credentials after initial access?
A: The breach stops being about the first entry point and becomes about reachable privilege.
Q: Why do privileged network accounts increase the impact of device vulnerabilities?
A: Privileged network accounts increase impact because they can unlock management functions that ordinary users never see.
Q: How do teams know whether unauthorized access controls are actually working?
A: Look for fewer standing credentials, lower lateral movement potential, and faster revocation when access is no longer needed.
Practitioner guidance
- Inventory all privileged network access paths Map who can authenticate to Cisco IOS and similar devices, including shared admin accounts, local credentials, and third-party management access.
- Restrict management-plane exposure Limit SNMP and administrative interfaces to trusted networks, approved jump hosts, and short-lived maintenance windows.
- Separate low-privilege monitoring from high-privilege administration Use distinct accounts and role tiers for read-only monitoring, configuration review, and root-level maintenance so a single credential cannot unlock all device actions.
What's in the full article
Expel's full article covers the operational detail this post intentionally leaves for the source:
- The exact monthly Patch Tuesday breakdown for the 175 CVEs and which issues Expel prioritised first.
- The Cisco IOS exploitation notes, including the credential precondition and the two different privilege outcomes.
- The vendor's remediation guidance for patching, SNMP restriction, and suspicious activity monitoring.
- The broader vulnerability prioritisation context across Microsoft's October release set.
👉 Read Expel's analysis of October Patch Tuesday and the Cisco IOS zero-day →
Cisco IOS zero-day exploitation: what IAM teams should notice?
Explore further
20/08/2026 6:38 pm
Credential-gated infrastructure exploitation is a governance problem, not just a patching problem. This Cisco IOS case shows that an attacker can move from authentication to device compromise when privileged access is already exposed. The control failure is not only vulnerable software, but the assumption that any authenticated session on a network device is trustworthy. Practitioners should treat privileged network access as a governed identity event.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when a network device is compromised through stolen credentials?
A: Accountability usually spans operations, security, and identity governance because the failure crosses control boundaries. Operations owns device hardening and management-plane exposure, security owns detection and incident response, and identity teams own credential lifecycle and privilege design. Frameworks such as NIST SP 800-53 and CIS Controls make that shared responsibility explicit.
👉 Read our full editorial: Patch Tuesday exposed a credential-gated Cisco IOS zero-day
