Loading story…
Cisco disclosed CVE-2026-20086, a high-severity denial-of-service vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family. The flaw affects the handling of Control and Provisioning of Wireless Access Points (CAPWAP) traffic and stems from improper processing of a malformed CAPWAP packet, mapped to CWE-230.
An unauthenticated remote attacker can exploit the issue by sending a crafted malformed packet to a vulnerable wireless controller, causing the device to reload unexpectedly and creating a denial-of-service condition. Cisco assigned the issue a CVSS v3.1 score with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating low-complexity network exploitation with high impact on availability.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco PSIRT received the vulnerability report for CVE-2026-20086 and tracked it as a CAPWAP packet processing flaw affecting Catalyst CW9800 wireless controllers. The issue was characterized as remotely exploitable without authentication and assigned a high-severity CVSS v3.1 score reflecting availability impact.
Cisco published a security advisory for a denial-of-service vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family involving CAPWAP packet processing. The advisory disclosed that malformed CAPWAP packets could cause an affected device to reload unexpectedly, resulting in a DoS condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software allows unauthenticated, remote attackers to cause affected devices to reload, resulting in a denial of service condition. The flaw arises from improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets, which can be exploited by sending specially crafted packets through the device. Cisco has released software updates to address this vulnerability, but no workarounds are available. The vulnerability is tracked as CVE-2025-20315 and has a CVSS score of 8.6.
Jun 29, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026