Loading story…
Cisco has released security updates addressing three vulnerabilities in its IOS XR software, including a critical ARP flaw (CVE-2025-20340) that could enable denial-of-service attacks. Additional vulnerabilities include an image verification bypass (CVE-2025-20248) and an ACL bypass issue (CVE-2025-20159). Cisco urges immediate patching, though no active exploitation has been reported.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026
Cisco has released security updates for roughly two dozen vulnerabilities across **Catalyst SD-WAN**, **IOS XE**, **IOS Software**, **Secure Firewall Management Center (FMC)**, and **Integrated Management Controller (IMC)**, including several critical and high-severity flaws. The most severe issue, **`CVE-2026-20079`** in FMC, carries a **CVSS 10.0** rating and could allow a remote unauthenticated attacker to send crafted HTTP requests, execute scripts, and obtain **root privileges**. Cisco also patched critical weaknesses in SD-WAN and IOS XE, while a notable IMC flaw, **`CVE-2026-20200`**, affects **UCS C-Series M7 and M8 Rack Servers** in standalone mode and has publicly available proof-of-concept code.
Aug 6, 2026
Cisco released security updates for 14 vulnerabilities in **Cisco IOS** and **Cisco IOS XE**, including the actively exploited zero-day **`CVE-2025-20352`**. The flaw is a stack overflow in the SNMP subsystem that can be triggered with crafted SNMP packets over IPv4 or IPv6. Cisco said a remote authenticated attacker can cause a denial of service, while an authenticated attacker with administrator privileges can escalate to remote code execution and full device compromise. Affected products include unpatched Cisco IOS and IOS XE devices, along with **Meraki MS390** and **Cisco Catalyst 9300 Series** switches running **Meraki CS 17 or earlier** when SNMP is enabled and vulnerable OIDs have not been explicitly disabled. Cisco urged organizations to use its **Software Checker** to identify exposure and apply fixes immediately; where patching is not yet possible, recommended mitigations include restricting SNMP access to trusted sources, disabling SNMP, or disabling vulnerable OIDs through device configuration.
Jul 24, 2026