CVE-2014-3326: SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authen...

Security readout for executives and security teams

Cisco Security Manager 4.5 and 4.6 had a SQL injection flaw in its web framework. An authenticated remote user could potentially run arbitrary SQL commands. The public bundle does not provide CVSS scoring, vector details, patch details, or evidence of active exploitation. Exposure is most likely where Cisco Security Manager 4.5 or 4.6 remains deployed and its web interface is reachable by authenticated users. Because vectors are unspecified, validation should focus on version inventory, access paths, authentication boundaries, and vendor advisory status. Treat this as a high-priority legacy platform risk if Cisco Security Manager 4.5 or 4.6 is present. The issue requires authenticated access, but it affects a security management product and could expose sensitive operational data. If the product is retired, document non-exposure. Mitigation focus: Identify any Cisco Security Manager 4.5 or 4.6 deployments.; Check Cisco's advisory for the supported fixed release or workaround.; Restrict web interface access to trusted administrative networks only..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.