Ethical Hacking News

Cisco Addresses Multiple Critical Security Vulnerabilities in SD-WAN and IOS XE Software

Cisco has addressed 12 significant security vulnerabilities in its Catalyst SD-WAN software and IOS XE software. These include three severe flaws with a CVSS score of 9.8 or higher, as well as seven others that have been fixed in the latest versions of the respective software.

Cisco has identified and addressed 12 critical security vulnerabilities in its Catalyst SD-WAN software and IOS XE software.

The vulnerabilities include improper input validation, access control, command injection, and storage of sensitive information.

Cisco is urging customers to apply the necessary updates for optimal protection against these potential threats.

The vulnerabilities impacting Catalyst SD-WAN Software have been addressed in versions 20.9-20.18 and 26.1.

The vulnerabilities impacting IOS XE Software relate to improper access control, command injection, and input validation.

Cisco has shipped fixes for a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC).

Cisco has recently taken steps to address multiple critical security vulnerabilities impacting its Catalyst SD-WAN software and IOS XE software, as part of a comprehensive internal security review. The move comes after the discovery of 12 significant security flaws, including three with a CVSS score of 9.8 or higher.

According to Cisco, these vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models, and are not known to be actively exploited by malicious actors at this time. The company is urging customers to apply the necessary updates for optimal protection against these potential threats.

The vulnerabilities impacting Catalyst SD-WAN Software are listed below:
CVE-2026-20303 (CVSS score: 9.9) - An improper input validation vulnerability which also covers path traversals
CVE-2026-20304 (CVSS score: 9.9) - An improper access control vulnerability
CVE-2026-20310 (CVSS score: 9.9) - An improper link resolution before file access vulnerability
CVE-2026-20312 (CVSS score: 8.8) - A cleartext storage of sensitive information vulnerability
CVE-2026-20313 (CVSS score: 7.7) - An improper validation of specified quantity in input

The issues have been addressed in the following versions of Cisco Catalyst SD-WAN Software:
20.9 (Fixed in 20.9.10)
20.10 (Fixed in 20.12.8.1)
20.111 (Fixed in 20.12.8.1)
20.12 (Fixed in 20.12.8.1)
20.131 (Fixed in 20.15.6)
20.141 (Fixed in 20.15.6)
20.15 (Fixed in 20.15.6)
20.161 (Fixed in 20.18.4)
20.18 (Fixed in 20.18.4)
26.1 (Fixed in 26.1.2)

Earlier than 20.9, customers are advised to migrate to a fixed release.

The vulnerabilities impacting IOS XE Software relate to improper access control, command injection, and improper input validation:
CVE-2026-20267 (CVSS score: 9.0) - An improper access control vulnerability
CVE-2026-20268 (CVSS score: 8.6) - A set of buffer overflow and out-of-bounds write vulnerabilities
CVE-2026-20269 (CVSS score: 8.6) - An improper control of a resource through its lifetime vulnerability
CVE-2026-20270 (CVSS score: 8.6) - An incorrect calculation vulnerability which also covers arithmetic or numeric conversion errors including integer overflow, underflow, and truncation
CVE-2026-20271 (CVSS score: 8.6) - An insufficient control flow management vulnerability which also covers infinite loops, uncontrolled recursion, and race conditions
CVE-2026-20272 (CVSS score: 9.8) - An improper neutralization of special elements vulnerability which also covers command, operating system, and argument injection
CVE-2026-20273 (CVSS score: 8.6) - An improper input validation vulnerability which also covers path traversals

The set of seven flaws has been addressed in the following versions of Cisco IOS XE Software:
17.9 (Fixed in 17.9.10)
17.12 (Fixed in 17.12.8)
17.15 (Fixed in 17.15.6)
17.18 (Fixed in 17.18.4 and 17.18.4a)
26.1 (Fixed in 26.1.2)

Additionally, Cisco has shipped fixes to address a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC), for which it acknowledged a proof-of-concept (PoC) exploit is available.

CVE-2026-20200 (CVSS score: 8.8) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
CVE-2026-20288 (CVSS score: 6.5) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.

"An attacker who gains root here can thereby nest themselves deeply and persistently in the system – far below what classic protective measures such as EDR solutions at the operating-system level can even see. The trust anchor of the entire server hardware is thus compromised," said security researcher Christoph Peil, who discovered and reported CVE-2026-20200.

Related Information:

https://www.ethicalhackingnews.com/articles/Cisco-Addresses-Multiple-Critical-Security-Vulnerabilities-in-SD-WAN-and-IOS-XE-Software-ehn.shtml

https://thehackernews.com/2026/08/cisco-patches-12-sd-wan-and-ios-xe.html

https://nvd.nist.gov/vuln/detail/CVE-2026-20303

https://www.cvedetails.com/cve/CVE-2026-20303/

https://nvd.nist.gov/vuln/detail/CVE-2026-20304

https://www.cvedetails.com/cve/CVE-2026-20304/

https://nvd.nist.gov/vuln/detail/CVE-2026-20310

https://www.cvedetails.com/cve/CVE-2026-20310/

https://nvd.nist.gov/vuln/detail/CVE-2026-20312

https://www.cvedetails.com/cve/CVE-2026-20312/

https://nvd.nist.gov/vuln/detail/CVE-2026-20313

https://www.cvedetails.com/cve/CVE-2026-20313/