Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
Intelligence analysis by Llama
Cisco has patched 12 security flaws in its Catalyst SD-WAN and IOS XE Software, including three with a 9.8 CVSS score. The vulnerabilities affect various versions of the software and have been addressed in the latest updates.
Imagine you have a super powerful computer that controls many other computers. If someone finds a way to hack into this computer, they could control all the other computers too. Cisco has fixed some security holes in their software to prevent this from happening.
Analysis
Vulnerabilities in Catalyst SD-WAN Software
Cisco has identified several vulnerabilities in its Catalyst SD-WAN Software, including CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, and CVE-2026-20312. These vulnerabilities affect various versions of the software, including 20.9, 20.10, 20.111, 20.12, 20.131, 20.141, 20.15, 20.161, 20.18, and 26.1. The company has released updates to address these vulnerabilities, and customers are urged to apply the necessary patches for optimal protection.
Vulnerabilities in IOS XE Software
In addition to the vulnerabilities in Catalyst SD-WAN Software, Cisco has also identified several vulnerabilities in its IOS XE Software. These vulnerabilities include CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20272, and CVE-2026-20273. These vulnerabilities affect various versions of the software, including 17.9, 17.12, 17.15, 17.18, and 26.1. The company has released updates to address these vulnerabilities, and customers are urged to apply the necessary patches for optimal protection.
IMC Web-Based Management Interface Flaw
Separately, Cisco has also shipped fixes to address a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC). The flaw, identified as CVE-2026-20200, could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. The company has released updates to address this vulnerability, and customers are urged to apply the necessary patches for optimal protection.
Key points
- Cisco has patched 12 security flaws in its Catalyst SD-WAN and IOS XE Software.
- The vulnerabilities affect various versions of the software, including 20.9, 20.10, 20.111, 20.12, 20.131, 20.141, 20.15, 20.161, 20.18, and 26.1.
- The company has released updates to address these vulnerabilities, and customers are urged to apply the necessary patches for optimal protection.
- A high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC) has also been addressed.
- The flaw, identified as CVE-2026-20200, could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
If Cisco's patches are applied successfully, the risk of these vulnerabilities being exploited will be significantly reduced. This will help protect customers' networks and prevent potential security breaches.
If the patches are not applied in a timely manner, the vulnerabilities could be exploited, leading to security breaches and potential data loss. Additionally, the high-severity flaw in the IMC web-based management interface could allow attackers to execute arbitrary commands and elevate privileges to root.
