Cisco has released a critical security update for its Cisco IOS XE software, addressing several serious vulnerabilities that could expose enterprise network devices to remote attacks. The advisory details issues identified during internal testing, including those supported by advanced AI models. The vulnerabilities impact devices running Cisco IOS XE Software in either autonomous mode or controller mode, regardless of configuration.
The Catalyst 3650 and 3850 Series Switches were excluded from the evaluation due to their non-supported operating system. This vulnerability falls under CWE-284 and includes risks involving authentication bypasses, authorization failures, privilege issues, and other access-control weaknesses.
CVE ID Vulnerability Class CWE Maximum CVSS Score CVE-2026-20267: Improper access control CWE-284: 9.0 CVE-2026-20268: Improper restriction of operations within a memory buffer CWE-119: 8.6 CVE-2026-20269: Improper control of a resource through its lifetime CWE-664: 8.6 CVE-2026-20270: Incorrect calculation CWE-682: 8.6 CVE-2026-20271: Insufficient control-flow management CWE-691: 8.6 CVE-2026-20272: Improper neutralization of special elements, including command injection CWE-74: 9.8 CVE-2026-20273: Improper input validation CWE-20: 8.6 Cisco has confirmed that there are no workarounds for these flaws. Cisco strongly recommends affected organizations immediately upgrade to fixed software releases, as outlined in advisory cisco-sa-hardening-iosxe-V8NMuMZJ published on August 5, 2026. Since IOS XE devices typically handle core routing, switching, wireless, and controller functions, patching should be meticulously planned as a high-priority security task.
