Loading story…
Cisco released security hardening updates for Cisco IOS XE Software to address multiple remotely exploitable vulnerabilities affecting a broad range of releases across the 16.x, 17.x, and 26.1.x/26.1.1 trains. The most severe issue, CVE-2026-20272 (CVSS 9.8), is tied to improper neutralization of special elements (CWE-74) and creates command-injection-related risk. Cisco also disclosed CVE-2026-20267 (CVSS 9.0) for improper access control, along with CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, and CVE-2026-20273, each rated 8.6, covering memory-buffer flaws, resource lifetime issues, incorrect calculation, insufficient control flow management, and improper input validation.
Cisco said the flaws were internally discovered, can be exploited remotely, and in several cases require no privileges or user interaction, raising the risk to enterprise network devices running IOS XE in autonomous or controller mode. The company said no workarounds are available and directed customers to install the latest hardened IOS XE releases and related patches through advisory cisco-sa-hardening-iosxe-V8NMuMZJ. Cisco added that it is not aware of public exploitation or malicious activity linked to the vulnerabilities, but urged organizations to upgrade affected systems promptly to fully remediate the exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco stated that it is not aware of public exploitation or malicious activity associated with the IOS XE vulnerabilities at the time of disclosure. The company nevertheless urged affected organizations to patch immediately.
Cisco disclosed that affected versions span numerous IOS XE 16.x, 17.x, and 26.1.1 releases, and identified the first patched versions as 17.9.10, 17.12.8, 17.15.6, 17.18.4 or 17.18.4a, and 26.1.2. Cisco said devices running in autonomous or controller mode are affected regardless of configuration.
On August 5, 2026, Cisco PSIRT published or newly received CVE records for seven Cisco IOS XE Software vulnerabilities, including the critical CVE-2026-20272 and CVE-2026-20267 plus five high-severity flaws. The records describe the weaknesses as remotely exploitable and affecting broad IOS XE release trains.
On August 5, 2026, Cisco published advisory cisco-sa-hardening-iosxe-V8NMuMZJ and released software hardening updates for Cisco IOS XE Software to address CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20272, and CVE-2026-20273. Cisco said no workarounds are available and directed customers to upgrade to fixed releases.
Cisco said a comprehensive internal security review by the IOS XE Software engineering team identified multiple internally discovered vulnerabilities that were later addressed through software hardening releases. Cyber Accord added that the testing included support from frontier AI models.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **Cisco IOS** and **Cisco IOS XE** devices have exposed routers, switches, access points, and Catalyst 9000 platforms to severe compromise, including **remote code execution**, **denial of service**, **access control bypass**, **privilege escalation**, **secure boot bypass**, **cross-site scripting**, and memory corruption. Traficom highlighted newly disclosed flaws such as `CVE-2025-20334` and `CVE-2025-20363`, which may allow arbitrary code execution, and urged organizations to update affected products in line with Cisco’s version-specific advisories. The warning follows earlier real-world attacks against internet-exposed Cisco IOS XE Web GUI instances, where attackers exploited `CVE-2023-20198` and `CVE-2023-20273` to create unauthorized administrator accounts, install a backdoor implant, and seize full control of devices. Cisco Talos reported the campaign affected exposed systems internationally, with tens of thousands of vulnerable devices identified online, while Finnish authorities said some domestic devices had already been backdoored and advised restricting Web GUI access to trusted networks or removing public internet exposure entirely.
Jun 29, 2026
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026
Cisco has released security updates for roughly two dozen vulnerabilities across **Catalyst SD-WAN**, **IOS XE**, **IOS Software**, **Secure Firewall Management Center (FMC)**, and **Integrated Management Controller (IMC)**, including several critical and high-severity flaws. The most severe issue, **`CVE-2026-20079`** in FMC, carries a **CVSS 10.0** rating and could allow a remote unauthenticated attacker to send crafted HTTP requests, execute scripts, and obtain **root privileges**. Cisco also patched critical weaknesses in SD-WAN and IOS XE, while a notable IMC flaw, **`CVE-2026-20200`**, affects **UCS C-Series M7 and M8 Rack Servers** in standalone mode and has publicly available proof-of-concept code.
Aug 6, 2026