CVE-2006-4098: Stack-based buffer overflow in the CSRadius service in Cisco Secure Access Control Server (ACS) for Windows...

Security readout for executives and security teams

This flaw affects legacy Cisco Secure ACS deployments and can let a remote attacker run code by sending a malicious RADIUS accounting request. Because ACS is identity and network-access infrastructure, compromise could affect authentication services. The bundle does not show active exploitation or modern scoring data. Exposure is limited to organizations still running Cisco Secure ACS for Windows or ACS Solution Engine versions before 4.1, especially where the CSRadius service accepts RADIUS accounting traffic from reachable networks. Treat as high priority only if legacy Cisco ACS remains deployed. The business risk is potential compromise of network-access infrastructure, but urgency is lower where ACS is retired, segmented, or not accepting untrusted accounting traffic. Mitigation focus: Identify and retire Cisco Secure ACS versions before 4.1.; Follow Cisco advisory guidance for the affected ACS product line.; Limit RADIUS accounting traffic to trusted network devices only..

Prepared

Jun 29, 2026, 08:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.