Cisco Advance Notification for Publication of September 2, 2026, Security Advisories
Cisco PSIRT published September 2, 2026 advisories including critical IOS XR hardening fixes and a Nexus 9000 remote code execution flaw.
Cisco's PSIRT released its September 2, 2026 batch of security advisories, including a Cisco IOS XR Software security hardening release bundling six CVEs (CVE-2026-20274 through CVE-2026-20280) rated critical with CVSS 9.8. A separate critical (CVSS 9.8) remote code execution vulnerability, CVE-2026-20212, affects Nexus 9000 Series switches with Silicon One, and a high-severity (CVSS 7.5) denial-of-service flaw, CVE-2026-20281, affects the Desk Phone 9800 Series and related SIP phones. Administrators should review the advisories and prioritize patching the critical-rated issues.
- IOS XR hardening release bundles six CVEs rated critical at CVSS 9.8
- CVE-2026-20212: critical RCE in Nexus 9000 Silicon One switches
- CVE-2026-20281: high-severity DoS in 9800/7800/8800 Series SIP phones, CVSS 7.5
- CVEs
- CVE-2026-20277CVE-2026-20278CVE-2026-20280CVE-2026-20279CVE-2026-20276CVE-2026-20275CVE-2026-20274CVE-2026-20212CVE-2026-20281
- Vendors
- Cisco
- Organizations
- Cisco PSIRT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20212 | Unauthenticated RCE in Cisco Nexus 9000 Switches with Silicon One Integration | 9.8 | <1% | ||
| CVE-2026-20274 | Critical Improper Resource Control Flaws in Cisco IOS XR Software | 9.8 group max | <1% | ||
| CVE-2026-20278 | Improper Neutralization Flaws in Cisco IOS XR Software (CWE-707) | 8.8 | <1% | ||
| CVE-2026-20281 | Unauthenticated Memory-Leak DoS in Cisco SIP Software for IP and Desk Phones | 7.5 | <1% |
From the original article
On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 CVE-2026-20277 CVE-2026-20278 CVE-2026-20280 CVE-2026-20279 CVE-2026-20276 CVE-2026-20275 CVE-2026-20274 Critical 9.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.