What is the official website of Cisco Community ?

The official website of Cisco Community is https://community.cisco.com/.

What is Cisco Community's cybersecurity risk score?

Cisco Community has an AI-generated cybersecurity risk score of 769 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Cisco Community experienced?

According to Rankiteo, Cisco Community currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Cisco Community been affected by any supply chain cyber incidents ?

According to Rankiteo, Cisco Community has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: OpenAI (Incident ID: BROOPECHECISOPEVULCTI1785407853) AsyncAPI Initiative (Incident ID: CISSONMICORAASYKNX1784341544) Cisco (Incident ID: CIS1784025731) Cholayil Private Limited (Incident ID: CIS1780568638) Splunk (Incident ID: SPLCIS1781519269) Microsoft Security (Incident ID: PUTWEBANYMIC1779215753) GitHub (Incident ID: GIT1779251025) Prime Communications MX (Incident ID: PRICIS1776775110) Aqua Security (Incident ID: AQUUSEAMASALCIS1775046662) Legit Security (Incident ID: AQU1774441468) Tecplix Technologies Private Limited (Incident ID: BAD1772389516) Cisco (Incident ID: CISSAI1773859283) ConnectWise (Incident ID: ARCCONO&OLOGKASORAWEBGOO1784262481) Cisco (Incident ID: CIS1766051696) SmarterTools (Incident ID: SHI1766477260) SolarWinds (Incident ID: SOLSONCIS1776457498) OpenClaw (Incident ID: TP-HIKFOXGOOREVARITHEOPECIS1770645410) Cisco (Incident ID: KET5232452102025) Cisco (Incident ID: CIS5802058092725) Cisco (Incident ID: SAL5732257091825) Cisco (Incident ID: US-1776976007) Salesforce (Incident ID: TRA1021410090425) Fortinet (Incident ID: FORCISAMAJPM1767748297) Veeam Software (Incident ID: SON0492204092925) SolarWinds (Incident ID: ZCAMIRGOOSOLCISTHE1780914449) Veeam Software (Incident ID: VEESONCIS1775140482)

Does Cisco Community have SOC 2 Type 1 certification ?

According to Rankiteo, Cisco Community is not certified under SOC 2 Type 1.

Does Cisco Community have SOC 2 Type 2 certification ?

According to Rankiteo, Cisco Community does not hold a SOC 2 Type 2 certification.

Does Cisco Community comply with GDPR ?

According to Rankiteo, Cisco Community is not listed as GDPR compliant.

Does Cisco Community have PCI DSS certification ?

According to Rankiteo, Cisco Community does not currently maintain PCI DSS compliance.

Does Cisco Community comply with HIPAA ?

According to Rankiteo, Cisco Community is not compliant with HIPAA regulations.

Does Cisco Community have ISO 27001 certification ?

According to Rankiteo,Cisco Community is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Cisco Community operate in ?

Cisco Community operates primarily in the IT Services and IT Consulting industry.

How many employees does Cisco Community have ?

Cisco Community employs approximately None employees people worldwide.

Does Cisco Community own any subsidiaries ?

Cisco Community presently has no subsidiaries across any sectors.

How many LinkedIn followers does Cisco Community have ?

Cisco Community's official LinkedIn profile has approximately 134,631 followers.

What is the NAICS classification code for Cisco Community ?

Cisco Community is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.

Does Cisco Community have a Crunchbase profile ?

No, Cisco Community does not have a profile on Crunchbase.

Does Cisco Community have a LinkedIn profile ?

Yes, Cisco Community maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cisco-community.

How many cybersecurity incidents has Cisco Community experienced ?

As of August 2, 2026, Rankiteo reports that Cisco Community has experienced 69 cybersecurity incidents.

How many peer or competitor companies does Cisco Community have ?

Cisco Community has an estimated 41,229 peer or competitor companies worldwide.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Cisco Community

Boost Score +25 with badge (5 left)

769

/1000

Fair

794

/1000

Fair

Cisco Community Vendor Cyber Rating & Cyber Score

cisco.com

Add Your Compliance Badge

A peer-to-peer online community where Cisco, customers and partners collaborate, co-create, share and learn. Community members connect to ask and answer questions, exchange ideas, voice opinions, and learn about current and upcoming Cisco products and services. #CiscoCommunity 1.5M+ users │ 7 languages │ community.cisco.com Learn more: http://cs.co/9008M4CUY

Cisco Community A.I CyberSecurity Scoring

Scoring History

Cisco Community

Cisco Community CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Cisco

Vulnerability

100

7/2026

OpenAI

BROOPECHECISOPE...

Cisco

Vulnerability

7/2026

AsyncAPI Initia...

CISSONMICORAASY...

Cisco

Vulnerability

7/2026

Cisco

CIS1784025731

Cisco

Vulnerability

7/2026

CIS1783002468

Cisco

Vulnerability

100

6/2026

CIS1781792750

Cisco

Breach

6/2026

CISTHE178059144...

Cisco

Vulnerability

100

6/2026

Cholayil Privat...

CIS1780568638

Cisco

Vulnerability

6/2026

CIS1781591050

Cisco

Vulnerability

100

6/2026

Splunk

SPLCIS178151926...

Cisco

Vulnerability

100

5/2026

CIS1779359208

Webex

Cyber Attack

5/2026

Microsoft Secur...

PUTWEBANYMIC177...

Cisco

Breach

5/2026

GitHub

GIT1779251025

Cisco Meraki

Vulnerability

4/2026

Prime Communica...

PRICIS177677511...

Cisco

Vulnerability

4/2026

CIS1776327928

Cisco

Vulnerability

100

4/2026

CIS1775493782

Cisco

Vulnerability

100

4/2026

CIS1775111249

Cisco

Ransomware

100

4/2026

MEDCISOPE178120...

Cisco

Vulnerability

100

4/2026

Aqua Security

AQUUSEAMASALCIS...

Cisco Security

Vulnerability

100

3/2026

CIS1774506416

Cisco

Cyber Attack

100

3/2026

Legit Security

AQU1774441468

Cisco

Vulnerability

3/2026

CIS1773304317

Outshift by Cisco

Cyber Attack

3/2026

NYLJPMOUTOUT177...

Cisco

Cyber Attack

100

3/2026

Tecplix Technol...

BAD1772389516

Cisco

Vulnerability

100

3/2026

CIS1772699055

Cisco

Vulnerability

100

2/2026

CIS1772080050

Cisco

Vulnerability

2/2026

CIS1770280632

Cisco

Vulnerability

100

1/2026

Cisco

CISSAI177385928...

Cisco

Vulnerability

1/2026

CISSYN177430507...

Cisco

Vulnerability

100

1/2026

CIS1769059373

Cisco

Vulnerability

1/2026

CIS1767871927

Cisco

Vulnerability

1/2026

CIS1778171136

Cisco

Vulnerability

100

1/2026

CIS1775125662

Webex

Cyber Attack

1/2026

ConnectWise

ARCCONO&OLOGKAS...

Cisco

Vulnerability

100

12/2025

Cisco

CIS1766051696

Cisco

Vulnerability

100

12/2025

CIS1783975142

Cisco

Breach

11/2025

SmarterTools

SHI1766477260

Cisco Community

Ransomware

100

11/2025

CIS070210711112...

Cisco

Vulnerability

100

11/2025

SolarWinds

SOLSONCIS177645...

Cisco Security

Cyber Attack

11/2025

OpenClaw

TP-HIKFOXGOOREV...

Cisco

Ransomware

100

10/2025

Cisco

KET523245210202...

Cisco

Cyber Attack

100

9/2025

Cisco

CIS580205809272...

Cisco

Cyber Attack

100

9/2025

Cisco

SAL573225709182...

Cisco

Cyber Attack

100

9/2025

Cisco

US-1776976007

Cisco Community

Vulnerability

100

8/2025

CIS069210609302...

Cisco

Breach

7/2025

Salesforce

TRA102141009042...

Cisco Community

Vulnerability

100

7/2025

CIS905072925

Cisco Community

Cyber Attack

100

6/2025

CIS526205209262...

Cisco Community

Vulnerability

100

5/2025

CIS751081525

Cisco

Breach

1/2025

CISVMWJUNCAN177...

Cisco

Vulnerability

100

12/2024

Fortinet

FORCISAMAJPM176...

Cisco Community

Cyber Attack

100

6/2024

CIS203202009282...

Cisco

Ransomware

100

6/2024

Veeam Software

SON049220409292...

Cisco Community

Vulnerability

100

4/2024

CIS000082424

Cisco

Ransomware

100

1/2024

CIS1774355311

Cisco

Cyber Attack

100

1/2024

DOMCISLINDRAFOR...

Cisco

Vulnerability

1/2024

SolarWinds

ZCAMIRGOOSOLCIS...

Cisco Community

Data Leak

11/2023

CIS1221121123

Cisco

Ransomware

100

3/2023

Veeam Software

VEESONCIS177514...

Cisco

Vulnerability

100

1/2023

CIS1772072640

Cisco Community

Breach

100

9/2022

CIS193291022

Cisco Community

Ransomware

08/2022

CIS0217922

Cisco Community

Ransomware

100

5/2022

CIS280222811112...

Cisco Community

Vulnerability

02/2022

CIS13829322

Cisco

Ransomware

100

7/2021

CIS1774362550

Cisco

Breach

1/2020

TICHARATTPRIMCD...

Cisco

Vulnerability

100

1/2020

BROMIC7-ENGICIS...

Cisco Community

Breach

9/2018

CIS205918123

Cisco Community

Vulnerability

100

6/2018

CIS929041225

Cisco Community

Breach

8/2016

CIS747072825

Loading…

A.I.

Cisco Community Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Cisco Community

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for Cisco Community in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Cisco Community in 2026.

Incident Types Cisco Community vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for Cisco Community in 2026.

Incident History - Cisco Community (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Cisco Community Subsidiaries

Cisco Community

IT Services and IT Consulting

Website: https://community.cisco.com/

Company Size: 10,001+ employees

CiscoSoftware Development

Cisco Networking AcademyComputer Networking Products

Cisco SecurityIT Services and IT Consulting

Cisco MerakiSoftware Development

Meraki GoTechnology, Information and Internet

Cisco NetworkingIT Services and IT Consulting

Loading…

Cisco Community Similar Companies

Tietoevry

tietoevry.com

In a rapidly changing world, technology is everything. It's in the fabric of society. In every part of every business. At the very heart of human evolution. It’s a great power that comes with great responsibility. At Tietoevry, we believe it’s time to shift perspective. It’s not about what technology can do anymore — but what it should. So that the futures of businesses, societies, and humanity can live and thrive. Side by side. This is why we're making it our business to create purposeful technology that reinvents the world for good. https://www.tietoevry.com/en/ #purposefultechnology #Tietoevry

Zoom

zoom.com

Bring teams together, reimagine workspaces, engage new audiences, and delight your customers –– all on the Zoom AI-first work platform you know and love. 💙 Zoomies help people stay connected so they can get more done together. We set out on a mission to make video communications frictionless and secure by building the world’s best video product for the enterprise, but we didn’t stop there. With products like AI Companion, Team Chat, Contact Center, Phone, Events, Rooms, Webinar, Contact Center and more, we bring innovation to a wide variety of customers, from the conference room to the classroom, from doctor’s offices to financial institutions to government agencies, from global brands to small businesses. We do what we do because of our core value of Care: care for our community, our customers, our company, our teammates, and ourselves. Our global employees help our customers meet happier, communicate better, and create meaningful connections the world over. Zoomies are problem-solvers and self-starters, working hard to get results and moving quickly to design solutions with our customers and users in mind. Here, you'll find room to grow with opportunities to stretch your skills and advance your career in a collaborative, growth-focused environment. Learn more about careers at Zoom by visiting our careers site: https://careers.zoom.us/home

NCS Group

ncs.co

NCS, a subsidiary of Singtel Group, is a leading technology services firm with presence in Asia Pacific and partners with governments and enterprises to advance communities through technology. Combining the experience and expertise of its 14,000-strong team across 56 specialisations, NCS provides differentiated and end-to-end technology services to clients with its NEXT capabilities in digital, data, cloud and platforms, as well as core offerings in application, infrastructure, engineering and cybersecurity. NCS also believes in building a strong partner ecosystem with leading technology players, research institutions and start-ups to support open innovation and co-creation. For more information, visit ncs.co.

Serco

serco.com

We bring together the right people, the right technology and the right partners to create innovative solutions that make positive impact and address some of the most urgent and complex challenges facing the modern world. With a focus on serving governments globally, Serco’s services span justice, migration, defence, space, customer services, health, and transport. Our core capabilities include service design and advisory, resourcing, complex programme management, systems integration, case management, engineering, and asset & facilities management.

Amadeus

amadeus.com

We make the experience of travel better for everyone, everywhere by inspiring innovation, partnerships and responsibility to people, places and planet. Our technology powers the travel and tourism industry. We inspire more connected ways of thinking, centered around the traveler. Our platform connects the travel and hospitality ecosystem. We are making travel a force for social and environmental good. We are passionate about travel. With a unique perspective, at the heart of our industry, we are redesigning the travel of tomorrow.

Lenovo

lenovo.com

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #196 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Guided by its vision of “Smarter Technology for All”, Lenovo is executing a Hybrid AI strategy that spans Personal AI – one personal AI, multiple devices; and Enterprise AI – helping customers turn data into insights and value. This strategy is delivered through the Group’s commitment to world-class innovation and a full-stack AI portfolio, including devices (PCs, workstations, smartphones, tablets, accessories), infrastructure solutions (server, storage, edge, high performance computing and software defined infrastructure), as well as software, solutions, and services. With a global footprint spanning 21 research and development locations in 11 markets, and a global supply chain including more than 30 manufacturing sites across 10 markets, Lenovo is widely recognized for its operational excellence, including ranking #8 in the Gartner Supply Chain Top 25. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY). To find out more visit https://www.lenovo.com, and read about the latest news via our StoryHub at https://news.lenovo.com/. To learn more about our career opportunities, visit our careers page at http://jobs.lenovo.com/.

Swisscom

swisscom.ch

As No. 1, we inspire people in the connected world. With the latest technologies and innovations, together we have the opportunity to shape the future. To do this, we are and act trustworthy, committed and curious. Are you with us? Join us on this exciting journey and work with us or in one of the DevOps Centres in Riga or Rotterdam in different business areas on the latest technological trends. Find out more about us and our vacancies on our careers page: www.swisscom.ch/career We look forward to hearing from you!

CDW

cb cdw.com

At CDW, we know how to make technology work so people can do great things. Our experts bring a full-stack, full-lifestyle approach with custom solutions, services and relationships to bring your vision to life. Through decades of experience, scale, and deep industry expertise, we deliver the full promise of what technology can do to help you reach your goals and drive innovation. Partner with CDW, and together, let’s Make amazing happen. A Fortune 500 company and member of the S&P 500 Index, CDW helps its customers to navigate an increasingly complex IT market and maximize return on their technology investments. For more information about CDW, please visit www.CDW.com.

GFT Technologies

gft.com

GFT Technologies is an AI-centric global digital transformation company. We design advanced data and AI transformation solutions, modernize technology architectures and develop next-generation core systems for industry leaders in Banking, Insurance, Manufacturing and Robotics. Partnering closely with our clients, we push boundaries to unlock their full potential. With deep industry expertise, cutting-edge technology, and a strong partner ecosystem, GFT delivers responsible AI-centric solutions that combine engineering excellence, high-performance delivery and cost efficiency. Our team of 12,000+ technology experts operate in 20+ countries worldwide offering career opportunities at the forefront of software innovation. Let’s Go Beyond_ Legal Disclaimer: https://www.gft.com/int/en/legal-disclaimer

Loading…

NEWS

Cisco Community CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

January 18, 2026 02:03 AM

#Ad paid and presented by Cisco. Opening the doors to education

Cisco Networking Academy partners with several educational institutions to provide digital training for remote communities.

Read Article

January 09, 2026 08:00 AM

Cisco Small Business Switches Face Global DNS Crash Outage

Network administrators worldwide reported widespread crashes in Cisco small business switches on January 8, 2026, triggered by fatal errors...

Read Article

December 10, 2025 02:45 PM

Cyber Resilience for All: How Cisco and NIIT Foundation Are Securing India’s Digital Future

As India undergoes rapid digital transformation, the opportunities are immense — but so are the risks. Cybercrime losses exceeded ₹1,750 crore in the first...

Read Article

November 10, 2025 08:00 AM

Fostering connection across Latin America with Cisco Networking Academy

Discover how Cisco Networking Academy is accelerating digital transformation across Latin America through innovative partnerships, hands-on...

Read Article

November 07, 2025 08:00 AM

NJCU Expands Cybersecurity Training With Cisco, SHI

Partnerships with Cisco and SHI International Corp. will bring enterprise tools and competition events to students in New Jersey City...

Read Article

October 31, 2025 07:00 AM

SecureBERT 2.0: Cisco’s next-gen AI model powering cybersecurity applications

Today, we are excited to share that the SecureBERT 2.0 model is available on HuggingFace and GitHub with an accompanying research paper.

Read Article

October 29, 2025 07:00 AM

Tarun Anthony

Tarun Anthony serves as a Project Manager within the Corporate Social Responsibility (CSR) team at Cisco India, operating under the Social...

Read Article

October 17, 2025 07:00 AM

Cisco IOS and IOS XE Software Vulnerabilities Let Attackers Execute Remote Code

Cisco has disclosed a severe vulnerability in its widely used IOS and IOS XE Software, potentially allowing attackers to crash devices or...

Read Article

October 16, 2025 07:00 AM

Find Yourself in the Future: How Generative AI is Reshaping Entry-Level Cybersecurity Job Roles

Cisco Networking Academy examines the transformative power of artificial intelligence (AI) and its impact on cybersecurity careers.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…