Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Software when it is running in autonomous or controller mode.
"These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models [...] and are not known to be actively exploited," Cisco said, urging customers to apply the necessary updates for optimal protection.
The vulnerabilities impacting Catalyst SD-WAN Software are listed below -
- CVE-2026-20303 (CVSS score: 9.9) - An improper input validation vulnerability (which also covers path traversals)
- CVE-2026-20304 (CVSS score: 9.9) - An improper access control vulnerability
- CVE-2026-20310 (CVSS score: 9.9) - An improper link resolution before file access vulnerability
- CVE-2026-20312 (CVSS score: 8.8) - A cleartext storage of sensitive information vulnerability
- CVE-2026-20313 (CVSS score: 7.7) - An improper validation of specified quantity in input
The issues have been addressed in the following versions of Cisco Catalyst SD-WAN Software -
- 20.9 (Fixed in 20.9.10)
- 20.10 (Fixed in 20.12.8.1)
- 20.111 (Fixed in 20.12.8.1)
- 20.12 (Fixed in 20.12.8.1)
- 20.131 (Fixed in 20.15.6)
- 20.141 (Fixed in 20.15.6)
- 20.15 (Fixed in 20.15.6)
- 20.161 (Fixed in 20.18.4)
- 20.18 (Fixed in 20.18.4)
- 26.1 (Fixed in 26.1.2)
- Earlier than 20.9 (Migrate to a fixed release)
The vulnerabilities impacting IOS XE Software relate to improper access control, command injection, and improper input validation -
- CVE-2026-20267 (CVSS score: 9.0) - An improper access control vulnerability
- CVE-2026-20268 (CVSS score: 8.6) - A set of buffer overflow and out-of-bounds write vulnerabilities
- CVE-2026-20269 (CVSS score: 8.6) - An improper control of a resource through its lifetime vulnerability
- CVE-2026-20270 (CVSS score: 8.6) - An incorrect calculation vulnerability (which also covers arithmetic or numeric conversion errors including integer overflow, underflow, and truncation)
- CVE-2026-20271 (CVSS score: 8.6) - An insufficient control flow management vulnerability (which also covers infinite loops, uncontrolled recursion, and race conditions)
- CVE-2026-20272 (CVSS score: 9.8) - An improper neutralization of special elements vulnerability (which also covers command, operating system, and argument injection)
- CVE-2026-20273 (CVSS score: 8.6) - An improper input validation vulnerability (which also covers path traversals)
The set of seven flaws has been addressed in the following versions of Cisco IOS XE Software -
- 17.9 (Fixed in 17.9.10)
- 17.12 (Fixed in 17.12.8)
- 17.15 (Fixed in 17.15.6)
- 17.18 (Fixed in 17.18.4 and 17.18.4a)
- 26.1 (Fixed in 26.1.2)
Separately, Cisco also shipped fixes to address a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC) (CVE-2026-20200) for which it acknowledged a proof-of-concept (PoC) exploit is available.
- CVE-2026-20200 (CVSS score: 8.8) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
- CVE-2026-20288 (CVSS score: 6.5) - An improper validation of user-supplied input that could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.
"One should be clear about what a compromise of the IMC means: the controller sits in a position where it can influence the BIOS and SecureBoot and interact with the operating system above it," security researcher Christoph Peil, who discovered and reported CVE-2026-20200, said.
"An attacker who gains root here can thereby nest themselves deeply and persistently in the system β far below what classic protective measures such as EDR solutions at the operating-system level can even see. The trust anchor of the entire server hardware is thus compromised."
The disclosure comes less than a week after the network equipment company warned of active exploitation of CVE-2026-20316 (CVSS score: 5.3), a vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow a low-privilege account to access sensitive data within susceptible systems.