Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20200 +1 in the same advisory: …20288 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary comman A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. NVD description · AI analysis pending | 8.8 group max | 6% |
| — | ||
| CVE-2026-20272 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive intern As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20272 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74. NVD description · AI analysis pending | 9.8 group max | <1% |
| — | ||
| CVE-2026-20303 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive intern As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20. NVD description · AI analysis pending | 9.9 group max | <1% | — | — | ||
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center, contains a use of hard-coded password vulnerability (CWE-259) that allows an unauthenticated, remote attacker to log in to an affected system. By authenticating with the built-in hard-coded credentials for a low-privileged account, the attacker can gain access to sensitive data within the impacted systems. Any organization running an affected Cisco FMC deployment is exposed, particularly where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-29, indicating active exploitation in the wild, and related reporting describes active exploitation of FMC vulnerabilities. No CVSS score or public proof-of-concept is yet available, but EPSS assigns a 9.8% probability of exploitation within 30 days (95th percentile). Do: Upgrade FMC to the fixed release per Cisco's security advisory, as no specific fixed version is provided in this data. Until patched, restrict access to the FMC management interface, audit recent logins against the affected low-privileged accounts, and rotate or remove any hard-coded credentials. Federal agencies must apply mitigations per CISA BOD 26-04 given the KEV listing dated 2026-07-29. | 5.3 | 11% | KEV ransomware |
| largeplausibly tens of thousands of FMC deployments worldwide (no published install base) |
Full article681 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 06, 2026Network Security / Vulnerability
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Software when it is running in autonomous or controller mode.
"These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models [...] and are not known to be actively exploited," Cisco said, urging customers to apply the necessary updates for optimal protection.
The vulnerabilities impacting Catalyst SD-WAN Software are listed below -
- CVE-2026-20303 (CVSS score: 9.9) - An improper input validation vulnerability (which also covers path traversals)
- CVE-2026-20304 (CVSS score: 9.9) - An improper access control vulnerability
- CVE-2026-20310 (CVSS score: 9.9) - An improper link resolution before file access vulnerability
- CVE-2026-20312 (CVSS score: 8.8) - A cleartext storage of sensitive information vulnerability
- CVE-2026-20313 (CVSS score: 7.7) - An improper validation of specified quantity in input
The issues have been addressed in the following versions of Cisco Catalyst SD-WAN Software -
- 20.9 (Fixed in 20.9.10)
- 20.10 (Fixed in 20.12.8.1)
- 20.111 (Fixed in 20.12.8.1)
- 20.12 (Fixed in 20.12.8.1)
- 20.131 (Fixed in 20.15.6)
- 20.141 (Fixed in 20.15.6)
- 20.15 (Fixed in 20.15.6)
- 20.161 (Fixed in 20.18.4)
- 20.18 (Fixed in 20.18.4)
- 26.1 (Fixed in 26.1.2)
- Earlier than 20.9 (Migrate to a fixed release)
The vulnerabilities impacting IOS XE Software relate to improper access control, command injection, and improper input validation -
- CVE-2026-20267 (CVSS score: 9.0) - An improper access control vulnerability
- CVE-2026-20268 (CVSS score: 8.6) - A set of buffer overflow and out-of-bounds write vulnerabilities
- CVE-2026-20269 (CVSS score: 8.6) - An improper control of a resource through its lifetime vulnerability
- CVE-2026-20270 (CVSS score: 8.6) - An incorrect calculation vulnerability (which also covers arithmetic or numeric conversion errors including integer overflow, underflow, and truncation)
- CVE-2026-20271 (CVSS score: 8.6) - An insufficient control flow management vulnerability (which also covers infinite loops, uncontrolled recursion, and race conditions)
- CVE-2026-20272 (CVSS score: 9.8) - An improper neutralization of special elements vulnerability (which also covers command, operating system, and argument injection)
- CVE-2026-20273 (CVSS score: 8.6) - An improper input validation vulnerability (which also covers path traversals)
The set of seven flaws has been addressed in the following versions of Cisco IOS XE Software -
- 17.9 (Fixed in 17.9.10)
- 17.12 (Fixed in 17.12.8)
- 17.15 (Fixed in 17.15.6)
- 17.18 (Fixed in 17.18.4 and 17.18.4a)
- 26.1 (Fixed in 26.1.2)
Separately, Cisco also shipped fixes to address a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC) (CVE-2026-20200 aka CIMCown) for which it acknowledged a proof-of-concept (PoC) exploit is available.
- CVE-2026-20200 (CVSS score: 8.8) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
- CVE-2026-20288 (CVSS score: 6.5) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
"One should be clear about what a compromise of the IMC means: the controller sits in a position where it can influence the BIOS and SecureBoot and interact with the operating system above it," security researcher Christoph Peil, who discovered and reported CVE-2026-20200, said.
"An attacker who gains root here can thereby nest themselves deeply and persistently in the system – far below what classic protective measures such as EDR solutions at the operating-system level can even see. The trust anchor of the entire server hardware is thus compromised."
The disclosure comes less than a week after the network equipment company warned of active exploitation of CVE-2026-20316 (CVSS score: 5.3), a vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow a low-privilege account to access sensitive data within susceptible systems.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/cisco-patches-12-sd-wan-and-ios-xe.html