Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities
Cisco releases patches for critical vulnerabilities in SD-WAN, IOS XE, and FMC.
Summary
Cisco has issued patches for two dozen vulnerabilities across its product line, including critical flaws in Catalyst SD-WAN, IOS XE, and Secure Firewall Management Center (FMC). The most severe issues include authentication bypass, command injection, and improper input validation, with some CVSS scores reaching 10.0. While Cisco is unaware of any active exploitation, proof-of-concept code exists for at least one high-severity vulnerability.
Full text
Cisco on Wednesday rolled out patches for two dozen vulnerabilities across its products, including critical-severity bugs in Catalyst SD-WAN, IOS XE, and Secure Firewall Management Center (FMC). For Catalyst SD-WAN, the company released five fixes, noting that the CVEs were assigned to multiple weaknesses grouped by the underlying vulnerability class. Three of the CVEs, namely CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, have a CVSS score of 9.9 and are described as improper input validation, improper access control, and improper link resolution before file access. The remaining two, CVE-2026-20312 and CVE-2026-20313, are high-severity flaws described as cleartext storage of sensitive information and improper validation of specified quantity in input. IOS XE received seven fixes, and the assigned CVEs group multiple issues by their underlying vulnerability class. Two of them, CVE-2026-20272 (CVSS score of 9.8) and CVE-2026-20267 (CVSS score of 9.0), are critical-severity command injection and improper access control defects, while the rest are high-severity flaws.Advertisement. Scroll to continue reading. FMC received patches for CVE-2026-20079 (CVSS score of 10), a critical authentication bypass that allows remote, unauthenticated attackers to execute scripts and gain root privileges. “An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device,” Cisco notes. The company also patched high-severity security defects in Integrated Management Controller (IMC), IOS XE, and IOS, and medium-severity bugs in IOS XE, Terminal Service (TS) Agent, Catalyst SD-WAN Manager, RoomOS, and IMC. Of these, CVE-2026-20200 (CVSS score of 8.8) deserves special attention. It is a high-severity improper validation of user-supplied input issue in IMC that could be exploited remotely to execute arbitrary commands and gain root privileges. While the flaw’s exploitation requires authentication, proof-of-concept (PoC) code targeting it exists, Cisco warns. The weakness affects UCS C-Series M7 and M8 Rack Servers in standalone mode. Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page. Related: Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability Related: Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks Related: N‑able Patches Vulnerability Exploited to Hack N-central Servers Related: Ruby on Rails Patches Critical Vulnerability Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire CISA Warns of Exploited Langflow, N-central, and Tomcat VulnerabilitiesOver 400 NPM Packages Infected in ChainDrop Supply Chain AttackOligo Raises $60 Million for Runtime SecurityZenity Raises $125 Million in Series C FundingGemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request TamperingDecades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks150,000 Impacted by Madera Community Hospital Data BreachRiver Bank Says Hackers Deleted Data Stolen in Ransomware Attack Latest News Hackers Start Exploiting Recent JetBrains TeamCity VulnerabilityHow a $50,000 Exploit Chain Turned Bixby Against Samsung Phones Black Hat USA 2026 – Summary of Vendor Announcements (Part 3)The Fourth Battlefield: The Growing Role of Cyber Operations in Global ConflictNew Attack Methods Enable Malware to Hijack Passkey-Protected Accounts311,000 Impacted by Brown Health Medical Group-MA Data BreachCybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data AI Agents Targeted Real People and Projects During Cybersecurity Tests Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.PNC Financial Services Group has appointed Christian Winward as CISO.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email
Indicators of Compromise
- cve — CVE-2026-20303
- cve — CVE-2026-20304
- cve — CVE-2026-20310
- cve — CVE-2026-20312
- cve — CVE-2026-20313
- cve — CVE-2026-20272
- cve — CVE-2026-20267
- cve — CVE-2026-20079
- cve — CVE-2026-20200