Cisco Patches 12 SD-WAN and IOS XE Flaws, Fixes IMC Bugs, Warns of FMC Exploitation
Summary
Cisco patched 12 Catalyst SD-WAN and IOS XE flaws, plus two IMC issues, one with a known proof-of-concept. The flaws were not known to be exploited; Cisco separately warned of active exploitation of an FMC vulnerability.
Key points
- Five Catalyst SD-WAN vulnerabilities include three rated CVSS 9.9; they affect devices regardless of configuration.
- Seven IOS XE flaws include a command-injection vulnerability rated CVSS 9.8; affected software runs in autonomous or controller mode.
- Cisco provided fixed releases for the affected SD-WAN and IOS XE branches and advises migrating versions earlier than 20.9 to a fixed release.
- Cisco also fixed two vulnerabilities in the web-based IMC management interface; a proof-of-concept exploit is available for CVE-2026-20200.
- Cisco said the SD-WAN and IOS XE flaws were found during internal testing and were not known to be actively exploited.
- Separately, Cisco warned that CVE-2026-20316 in Secure Firewall Management Center was being actively exploited to access sensitive data.
Article Details
- Vulnerability Types
- Improper input validation
- Path traversal
- Improper access control
- Improper link resolution before file access
- Cleartext storage of sensitive information
- Improper validation of specified quantity in input
- Buffer overflow
- Out-of-bounds write
- Improper control of a resource through its lifetime
- Incorrect calculation, including integer overflow, underflow, and truncation
- Insufficient control flow management, including infinite loops, uncontrolled recursion, and race conditions
- Improper neutralization of special elements, including command, operating system, and argument injection
- Severity
- Critical (up to CVSS 9.9); additional high- and medium-severity vulnerabilities
- Affected Versions
- Cisco Catalyst SD-WAN Software earlier than 20.9
- Cisco Catalyst SD-WAN Software 20.9
- Cisco Catalyst SD-WAN Software 20.10
- Cisco Catalyst SD-WAN Software 20.12
- Cisco Catalyst SD-WAN Software 20.15
- Cisco Catalyst SD-WAN Software 20.18
- Cisco Catalyst SD-WAN Software 26.1
- Cisco IOS XE Software 17.9
- Cisco IOS XE Software 17.12
- Cisco IOS XE Software 17.15
- Cisco IOS XE Software 17.18
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-20200Cisco · Unified computing systemsecurity flaw in the web-based management interface of Integrated Management Controller (IMC) (CVE-2026-20200) for which it acknowledged a proof-of-concept (PoC) exploit is available.CVE-2026-20267Cisco · Ios xeCVE-2026-20267 (CVSS score: 9.0) – An improper access control vulnerabilityCVE-2026-20268Cisco · Ios xeCVE-2026-20268 (CVSS score: 8.6) – A set of buffer overflow and out-of-bounds write vulnerabilitiesCVE-2026-20269Cisco · Ios xeCVE-2026-20269 (CVSS score: 8.6) – An improper control of a resource through its lifetime vulnerabilityCVE-2026-20270Cisco · Ios xeCVE-2026-20270 (CVSS score: 8.6) – An incorrect calculation vulnerability (which also covers arithmetic or numeric conversion errors including integer overflow, underflow, and truncation)CVE-2026-20271Cisco · Ios xeCVE-2026-20271 (CVSS score: 8.6) – An insufficient control flow management vulnerability (which also covers infinite loops, uncontrolled recursion, and race conditions)CVE-2026-20272Cisco · Ios xeCVE-2026-20272 (CVSS score: 9.8) – An improper neutralization of special elements vulnerability (which also covers command, operating system, and argument injection)CVE-2026-20273Cisco · Ios xeCVE-2026-20273 (CVSS score: 8.6) – An improper input validation vulnerability (which also covers path traversals)CVE-2026-20288Cisco · Unified computing system; Cisco · Unified computing system e-series softwareCVE-2026-20288 (CVSS score: 6.5) – An improper validation of user-supplied input that could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating systemCVE-2026-20303Vendor / Product unavailableCVE-2026-20303 (CVSS score: 9.9) – An improper input validation vulnerability (which also covers path traversals)CVE-2026-20304Vendor / Product unavailableCVE-2026-20304 (CVSS score: 9.9) – An improper access control vulnerability CVE-2026-20310Vendor / Product unavailableCVE-2026-20310 (CVSS score: 9.9) – An improper link resolution before file access vulnerabilityCVE-2026-20312Vendor / Product unavailableCVE-2026-20312 (CVSS score: 8.8) – A cleartext storage of sensitive information vulnerabilityCVE-2026-20313Vendor / Product unavailableCVE-2026-20313 (CVSS score: 7.7) – An improper validation of specified quantity in inputCVE-2026-20316Cisco · Cisco Secure Firewall Management Center (FMC)It also addressed a high-severity flaw in the Integrated Management Controller, while separately warning about active exploitation of CVE-2026-20316 in Cisco Secure Firewall Management Center.
People
Vendors
Products
Catalyst SD-WAN SoftwareCisco patched several critical flaws in Catalyst SD-WAN Software.Cisco IOS XECisco has released fixes for multiple critical vulnerabilities in Catalyst SD-WAN and IOS XE Software, discovered during internal testing and not known to be actively exploited.Cisco Secure Firewall Management Centerof active exploitation of CVE-2026-20316 (CVSS score: 5.3), a vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow a low-privilege account to access sensitive data withinIntegrated Management Controller (IMC)fixes to address a high-severity security flaw in the web-based management interface of Integrated Management Controller (IMC) (CVE-2026-20200) for which it acknowledged a proof-of-concept (PoC) exploit is available.