[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi0xG8cRTdLrKcI1Ai-R4RCTqz-XNabx9sMS_KBhkBOE":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":117},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"fbd265e5-e74f-4802-873a-0091e9ac4fd1","Asus, Zoom Release Security Patches","asus-zoom-release-security-patches-9f6bff","Attackers could exploit them for command execution, memory overwrites, and privilege escalation. The post Asus, Zoom Release Security Patches appeared first on SecurityWeek.","Asus has released an advisory for four high- and medium-severity vulnerabilities in its router firmware, which could allow command execution or memory overwrites. Zoom has patched two vulnerabilities in Workplace for Windows, including a critical-severity unauthenticated privilege escalation bug (CVE-2026-108186) and another privilege escalation flaw (CVE-2026-108187). Cisco also updated advisories for Node2Shell and an authorization bypass on ISE, and provided details on fixes for seven CVEs in Meraki products. Neither Asus nor Zoom have indicated exploitation in the wild.","Asus and Zoom release security patches for router firmware and Windows client.","https:\u002F\u002Fwww.securityweek.com\u002Fasus-zoom-release-security-patches\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F06\u002FASUS-Vulnerabillities.jpg","2026-11-11T13:58:38+00:00","2026-11-11T15:00:13.218087+00:00",7,[17,20,22,24,27,29],{"name":18,"type":19},"Asus","vendor",{"name":21,"type":19},"Zoom",{"name":23,"type":19},"Cisco",{"name":25,"type":26},"Workplace for Windows","product",{"name":28,"type":26},"ISE",{"name":30,"type":26},"Meraki","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-108186","Zoom Workplace for Windows privilege escalation vulnerability",{"type":46,"value":50,"context":48},"CVE-2026-108187",[23,18,21],{"controls":53,"vendors":111},[54,83],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":84,"product_name":108,"url":109,"description":110},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[112],{"slug":113,"name":23,"logo_path":114,"roles":115},"cisco","\u002Fvendor-logos\u002Fcisco.png",[116],"affected",{"slug":118,"title":119,"body":120,"framework_refs":121,"framework_notes":127},"critical-privilege-escalation-bugs-in-zoom-and-asus-routers-demand-prompt-patching","Critical Privilege Escalation Bugs in Zoom and Asus Routers Demand Prompt Patching","Asus, Zoom, and Cisco have all released patches addressing high- and critical-severity vulnerabilities, including an unauthenticated privilege escalation flaw in Zoom for Windows that requires no credentials to exploit. Router firmware vulnerabilities in Asus products could allow attackers to execute arbitrary commands or overwrite memory, posing serious risks to network infrastructure. While no active exploitation has been reported, unpatched systems remain exposed windows of opportunity for threat actors. Organizations that delay applying vendor patches — especially for internet-facing devices and widely used collaboration tools — dramatically increase their attack surface.",[122,123,124,125,126],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":128,"NIST SP 800-53 SI-2: Flaw Remediation":129,"CIS Control 7: Continuous Vulnerability Management (v8)":130,"CIS Control 2: Inventory and Control of Software Assets (v8)":131,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":132},"This provision requires security in acquisition and maintenance, including vulnerability handling, making it directly applicable to the obligation to track and apply vendor-issued patches for products like Zoom and Asus routers.","SI-2 requires organizations to identify, report, and correct information system flaws promptly, directly addressing the need to apply the Zoom privilege escalation and Asus firmware patches in a timely manner.","This control requires organizations to continuously assess and remediate vulnerabilities — a process that would have flagged the critical Zoom and Asus flaws for immediate patching before exploitation could occur.","Knowing exactly which versions of Zoom and router firmware are deployed across the organization is a prerequisite for identifying which systems need the patches released in this advisory.","This category requires organizations to act on newly disclosed vulnerabilities like those in Zoom and Asus router firmware, either by patching or formally accepting the risk."]