CVE-2026-20272

Cisco Publishes 12 Security Advisories Fixing Critical Flaws in Catalyst SD-WAN and IOS XE

Cisco Systems released 12 new security advisories on August 5, 2026, disclosing a total of 23 vulnerabilities across multiple products. Two advisories covering Cisco Catalyst SD-WAN Software and Cisco IOS XE Software received the highest Critical severity rating. The SD-WAN advisory addresses five issues, including CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, each scoring 9.9 on CVSSv3.1. The IOS XE advisory details seven vulnerabilities, with CVE-2026-20272 rated 9.8 and CVE-2026-20267 rated 9.0. Additional advisories cover flaws in Integrated Management Controller, RoomOS, and Terminal Services Agent. Organizations are urged to apply the hardening releases immediately to mitigate remote exploitation risks.

Cisco Patches Seven Critical IOS XE Vulnerabilities Including CVSS 9.8 Command Injection Flaw

Cisco has released security updates to address seven vulnerabilities in IOS XE, the operating system powering routers, switches, wireless controllers, and other enterprise network devices. The highest-severity issue, tracked as CVE-2026-20272 with a CVSS score of 9.8, stems from improper handling of special elements in commands and could enable remote command injection, unauthorized operations, and full device compromise over the network. Additional flaws impact memory management, resource lifecycle, numeric calculations, execution flow, and input validation, potentially leading to buffer overflows, out-of-bounds writes, crashes, infinite loops, and directory traversal. The vulnerabilities affect IOS XE versions 17.9, 17.12, 17.15, 17.18, and 26.1 in both standalone and controller modes regardless of configuration. Fixed releases include 17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, and 26.1.2, with no available workarounds. The issues were discovered during internal testing that incorporated advanced AI models, and no evidence of public exploitation has been observed.