CVE-2006-3226: Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port...

Security readout for executives and security teams

CVE-2006-3226 is a Cisco Secure ACS 4.x for Windows issue where an administration HTTP session could trust weak network identifiers instead of strong session authentication. If the admin interface is reachable, a remote attacker may bypass login and reach administrative functionality. Exposure is most likely where legacy Cisco Secure ACS 4.x for Windows remains deployed and its HTTP administration port is reachable from untrusted or broad internal networks. Treat as high priority if Cisco ACS 4.x for Windows is still present. It affects authentication infrastructure, and administrative compromise could undermine network access controls. Mitigation focus: Review Cisco's advisory for supported fixes, upgrades, or workarounds.; Restrict ACS administration HTTP access to trusted management hosts only.; Remove internet exposure from any ACS administration interface..

Prepared

Jun 29, 2026, 11:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.