Loading story…
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across Catalyst SD-WAN Software, IOS XE Software, IOS Software, and Integrated Management Controller, with additional advisories covering RoomOS, Secure Firewall Management Center, and Terminal Services Agent. The most severe issues include several critical flaws in Catalyst SD-WAN, including CVE-2026-20303 through CVE-2026-20313, and critical vulnerabilities in IOS XE that could allow authentication bypass, command injection, privilege escalation, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure.
Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On August 5, 2026, Cisco released a security bundle and related advisories addressing multiple vulnerabilities across Catalyst SD-WAN, IOS XE, IOS, Integrated Management Controller, RoomOS, Secure Firewall Management Center, and Terminal Services Agent. The updates included fixes for critical authentication-related flaws in SD-WAN and IOS XE, along with several other high- and medium-severity issues.
At the time of publication, Cisco said it had no evidence that the newly disclosed vulnerabilities were being actively exploited. This statement applied to the August 2026 set of disclosed issues affecting multiple Cisco products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco has released security updates for roughly two dozen vulnerabilities across **Catalyst SD-WAN**, **IOS XE**, **IOS Software**, **Secure Firewall Management Center (FMC)**, and **Integrated Management Controller (IMC)**, including several critical and high-severity flaws. The most severe issue, **`CVE-2026-20079`** in FMC, carries a **CVSS 10.0** rating and could allow a remote unauthenticated attacker to send crafted HTTP requests, execute scripts, and obtain **root privileges**. Cisco also patched critical weaknesses in SD-WAN and IOS XE, while a notable IMC flaw, **`CVE-2026-20200`**, affects **UCS C-Series M7 and M8 Rack Servers** in standalone mode and has publicly available proof-of-concept code.
Aug 6, 2026
Cisco released security hardening updates for **Catalyst SD-WAN** after an internal security review uncovered multiple remotely exploitable vulnerabilities affecting **Catalyst SD-WAN Controller** and **Catalyst SD-WAN Manager** across a wide range of software versions. The most severe issues include **CVE-2026-20303** and **CVE-2026-20304**, both rated **CVSS 9.9**, covering improper input validation and improper access control, as well as **CVE-2026-20310**, a critical improper link resolution flaw (`CWE-59`) rated **CVSS 9.1**. Cisco also disclosed **CVE-2026-20312**, an information disclosure issue tied to cleartext storage of sensitive information (`CWE-312`) with a **CVSS 8.8** score. Cisco said the vulnerabilities were discovered internally, including with assistance from frontier AI models, and that it has **no evidence of active exploitation**. The company said there are **no workarounds**, making upgrades to fixed or hardened releases the required remediation path; customers on unsupported versions may need to migrate before applying fixes. Cisco-managed **SD-WAN Cloud** customers do not need to take action because backend fixes were already applied in **Release 20.15.602**, while other organizations are being directed to update to the latest Catalyst SD-WAN software and review Cisco's advisory for affected-version details.
Aug 6, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026