Cisco has released a critical security hardening update for Cisco IOS XE Software, fixing several serious vulnerabilities that could expose enterprise network devices to remote attacks.
The advisory covers vulnerabilities identified during Cisco’s internal security testing, including testing supported by frontier AI models.
Cisco said it is not aware of public exploitation or malicious activity linked to these flaws. However, the severity of the issues, combined with the lack of available workarounds, makes prompt patching essential.
The vulnerabilities affect Cisco IOS XE Software running in autonomous mode or controller mode, regardless of device configuration. Cisco assessed releases 17.9, 17.12, 17.15, 17.18, and 26.1 as part of this review. Cisco Catalyst 3650 and 3850 Series Switches were not evaluated because they do not run the reviewed releases.
The most severe issue is CVE-2026-20272, which carries a maximum CVSS score of 9.8 out of 10. The flaw is linked to CWE-74, or improper neutralization of special elements. This weakness can include command injection, operating system injection, and argument injection risks.
Cisco Patches Critical IOS XE Flaws
If successfully exploited, such weaknesses may allow an attacker to execute unintended commands or alter how a system processes input.
Cisco also addressed CVE-2026-20267, an improper access control issue rated 9.0.
This vulnerability falls under CWE-284 and includes risks involving authentication bypasses, authorization failures, privilege issues, and other access-control weaknesses. Attackers could potentially abuse these conditions to gain access beyond their intended permissions.
Several other vulnerabilities received a maximum CVSS score of 8.6. CVE-2026-20268 involves memory buffer restrictions, including possible buffer overflows and out-of-bounds writes.
CVE-2026-20269 relates to improper resource lifetime management, such as invalid memory handling, null pointer dereferences, and file handler issues.
Cisco also patched CVE-2026-20270, which covers incorrect calculations and numeric conversion problems, including integer overflow and truncation.
CVE-2026-20271 addresses insufficient control-flow management, including race conditions, uncontrolled recursion, and infinite loops. CVE-2026-20273 concerns improper input validation, with potential impacts including path traversal and unsafe external path handling.
| CVE ID | Vulnerability Class | CWE | Maximum CVSS Score |
|---|---|---|---|
| CVE-2026-20267 | Improper access control | CWE-284 | 9.0 |
| CVE-2026-20268 | Improper restriction of operations within a memory buffer | CWE-119 | 8.6 |
| CVE-2026-20269 | Improper control of a resource through its lifetime | CWE-664 | 8.6 |
| CVE-2026-20270 | Incorrect calculation | CWE-682 | 8.6 |
| CVE-2026-20271 | Insufficient control-flow management | CWE-691 | 8.6 |
| CVE-2026-20272 | Improper neutralization of special elements, including command injection | CWE-74 | 9.8 |
| CVE-2026-20273 | Improper input validation | CWE-20 | 8.6 |
Cisco has confirmed that there are no workarounds for these flaws. Organizations using affected IOS XE releases must install the fixed software versions to remediate the exposure fully.
Cisco strongly recommends affected organizations immediately upgrade to fixed software releases, as outlined in advisory cisco-sa-hardening-iosxe-V8NMuMZJ published on August 5, 2026. The first patched versions are IOS XE 17.9.10, 17.12.8, 17.15.6, 17.18.4/17.18.4a, and 26.1.2.
Network administrators should first identify all Cisco IOS XE devices in their environment and confirm their currently installed release. They should then review hardware capacity, configuration compatibility, and maintenance windows before upgrading.
Because IOS XE devices often support core routing, switching, wireless, and controller functions, patching should be carefully planned and treated as a high-priority security task.
Cisco PSIRT validates only the affected and fixed release information listed in the advisory. Organizations should also monitor Cisco security advisories for additional fixes and upgrade guidance.