Cisco finally fixes max-severity bug under active attack for weeks