Loading story…
Cisco has released security updates for roughly two dozen vulnerabilities across Catalyst SD-WAN, IOS XE, IOS Software, Secure Firewall Management Center (FMC), and Integrated Management Controller (IMC), including several critical and high-severity flaws. The most severe issue, CVE-2026-20079 in FMC, carries a CVSS 10.0 rating and could allow a remote unauthenticated attacker to send crafted HTTP requests, execute scripts, and obtain root privileges. Cisco also patched critical weaknesses in SD-WAN and IOS XE, while a notable IMC flaw, CVE-2026-20200, affects UCS C-Series M7 and M8 Rack Servers in standalone mode and has publicly available proof-of-concept code.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A CSIRT Italia notice highlighted CVE-2026-20316, a static-credential vulnerability in Cisco Secure Firewall Management Center's web interface, as being actively exploited in the wild. The flaw allows an unauthenticated remote attacker to log in with a low-privilege account using static credentials and access sensitive data stored on the device.
Cisco stated that it was not aware of any of the patched vulnerabilities being exploited in the wild at the time of disclosure.
Cisco highlighted CVE-2026-20200 in Integrated Management Controller as a high-severity vulnerability that can allow authenticated remote command execution and root privilege gain on affected UCS C-Series M7 and M8 Rack Servers in standalone mode. Cisco also warned that proof-of-concept code exists for this flaw.
Cisco identified fixed release trains for affected products, including Catalyst SD-WAN versions 26.1.2, 20.18.4, 20.15.6, 20.12.8.1, and 20.9.10; IOS XE versions 26.1.2, 17.18.4, 17.15.6, 17.12.8, and 17.9.10; and IMC versions 6.0(2.260044) and 4.3(6.260033). For some issues, Cisco directed customers to use Cisco Software Checker to determine affected and remediated releases.
Cisco released patches and security updates for roughly two dozen vulnerabilities affecting Catalyst SD-WAN, IOS XE, IOS, Secure Firewall Management Center, and Integrated Management Controller. The updates included fixes for critical flaws such as FMC CVE-2026-20079, Catalyst SD-WAN CVE-2026-20303/CVE-2026-20304/CVE-2026-20310, IOS XE CVE-2026-20267/CVE-2026-20272, and IMC CVE-2026-20200.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcesecurityweek.com
Open sourceboho.or.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco released security hardening updates for **Catalyst SD-WAN** after an internal security review uncovered multiple remotely exploitable vulnerabilities affecting **Catalyst SD-WAN Controller** and **Catalyst SD-WAN Manager** across a wide range of software versions. The most severe issues include **CVE-2026-20303** and **CVE-2026-20304**, both rated **CVSS 9.9**, covering improper input validation and improper access control, as well as **CVE-2026-20310**, a critical improper link resolution flaw (`CWE-59`) rated **CVSS 9.1**. Cisco also disclosed **CVE-2026-20312**, an information disclosure issue tied to cleartext storage of sensitive information (`CWE-312`) with a **CVSS 8.8** score. Cisco said the vulnerabilities were discovered internally, including with assistance from frontier AI models, and that it has **no evidence of active exploitation**. The company said there are **no workarounds**, making upgrades to fixed or hardened releases the required remediation path; customers on unsupported versions may need to migrate before applying fixes. Cisco-managed **SD-WAN Cloud** customers do not need to take action because backend fixes were already applied in **Release 20.15.602**, while other organizations are being directed to update to the latest Catalyst SD-WAN software and review Cisco's advisory for affected-version details.
Aug 6, 2026