Loading story…
Cisco disclosed a critical vulnerability (CVE-2025-20334) in the HTTP API subsystem of IOS XE Software that allows remote attackers to execute arbitrary commands with root privileges. The flaw arises from insufficient input validation, enabling exploitation either by an authenticated attacker making crafted API calls or by tricking an authenticated administrator into clicking a malicious link. Cisco has released software updates to address the vulnerability, but no workarounds are available. The vulnerability affects multiple Cisco IOS XE products and poses a significant risk due to the potential for full system compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco published a security advisory for a command injection vulnerability affecting Cisco IOS XE Software's HTTP API. The issue was identified as CVE-2025-20334 and publicly disclosed through Cisco's advisory and vulnerability tracking sources.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **Cisco IOS** and **Cisco IOS XE** devices have exposed routers, switches, access points, and Catalyst 9000 platforms to severe compromise, including **remote code execution**, **denial of service**, **access control bypass**, **privilege escalation**, **secure boot bypass**, **cross-site scripting**, and memory corruption. Traficom highlighted newly disclosed flaws such as `CVE-2025-20334` and `CVE-2025-20363`, which may allow arbitrary code execution, and urged organizations to update affected products in line with Cisco’s version-specific advisories. The warning follows earlier real-world attacks against internet-exposed Cisco IOS XE Web GUI instances, where attackers exploited `CVE-2023-20198` and `CVE-2023-20273` to create unauthorized administrator accounts, install a backdoor implant, and seize full control of devices. Cisco Talos reported the campaign affected exposed systems internationally, with tens of thousands of vulnerable devices identified online, while Finnish authorities said some domestic devices had already been backdoored and advised restricting Web GUI access to trusted networks or removing public internet exposure entirely.
Jun 29, 2026
Cisco disclosed a high-severity zero-day vulnerability, CVE-2025-20352, affecting the SNMP subsystem in IOS and IOS XE software, which is being actively exploited in the wild. The flaw, a stack-based buffer overflow, allows authenticated remote attackers with low privileges to cause denial-of-service conditions, while high-privileged attackers can achieve remote code execution as root on vulnerable IOS XE devices. Cisco confirmed that attackers have exploited this vulnerability after compromising local administrator credentials, highlighting the risk of credential theft and chained attacks. The vulnerability affects all devices with SNMP enabled, including Meraki MS390 and Cisco Catalyst 9300 Series Switches, and impacts all SNMP versions (v1, v2c, v3). Cisco has released security updates and strongly urges customers to upgrade immediately, as no workarounds exist beyond restricting SNMP access to trusted users.
Jun 29, 2026
Cisco released security hardening updates for **Cisco IOS XE Software** to address multiple remotely exploitable vulnerabilities affecting a broad range of releases across the `16.x`, `17.x`, and `26.1.x/26.1.1` trains. The most severe issue, **`CVE-2026-20272`** (**CVSS 9.8**), is tied to **improper neutralization of special elements** (`CWE-74`) and creates command-injection-related risk. Cisco also disclosed **`CVE-2026-20267`** (**CVSS 9.0**) for improper access control, along with **`CVE-2026-20268`**, **`CVE-2026-20269`**, **`CVE-2026-20270`**, **`CVE-2026-20271`**, and **`CVE-2026-20273`**, each rated **8.6**, covering memory-buffer flaws, resource lifetime issues, incorrect calculation, insufficient control flow management, and improper input validation. Cisco said the flaws were internally discovered, can be exploited remotely, and in several cases require no privileges or user interaction, raising the risk to enterprise network devices running IOS XE in autonomous or controller mode. The company said **no workarounds are available** and directed customers to install the latest hardened IOS XE releases and related patches through advisory **`cisco-sa-hardening-iosxe-V8NMuMZJ`**. Cisco added that it is **not aware of public exploitation** or malicious activity linked to the vulnerabilities, but urged organizations to upgrade affected systems promptly to fully remediate the exposure.
Aug 9, 2026