Cisco has released a security hardening update for IOS XE Software, fixing seven vulnerabilities discovered internally, including a critical, maximum-impact flaw rated CVSS 9.8 that could allow unauthenticated attackers to execute code remotely.
Published August 5, 2026, advisory cisco-sa-hardening-iosxe-V8NMuMZJ (Version 1.0, Final) is the result of a proactive internal security review by Cisco’s IOS XE engineering team.
Unlike typical disclosures tied to external researcher reports or bug bounty submissions, Cisco confirmed these flaws were uncovered through internal testing that combined existing QA processes with frontier AI models.
Cisco Patches Critical IOS XE Vulnerabilities
Cisco has grouped the bugs by underlying Common Weakness Enumeration (CWE) class rather than issuing a separate CVE per bug, assigning a single CVE ID to each vulnerability category. The advisory carries a Critical severity rating overall, with no available workarounds.
| CVE ID | CVSS | CWE Class | Impact |
|---|---|---|---|
| CVE-2026-20272 | 9.8 | CWE-74 (Improper Neutralization) | Command/OS/argument injection |
| CVE-2026-20267 | 9.0 | CWE-284 (Improper Access Control) | Authorization/authentication bypass |
| CVE-2026-20268 | 8.6 | CWE-119 (Buffer Restriction) | Buffer overflow, out-of-bounds write |
| CVE-2026-20269 | 8.6 | CWE-664 (Resource Lifetime) | Memory/file handler flaws, null pointer dereference |
| CVE-2026-20270 | 8.6 | CWE-682 (Incorrect Calculation) | Integer overflow/underflow, truncation |
| CVE-2026-20271 | 8.6 | CWE-691 (Control Flow) | Infinite loops, uncontrolled recursion, race conditions |
| CVE-2026-20273 | 8.6 | CWE-20 (Input Validation) | Path traversal, external path control |
The most severe flaw, CVE-2026-20272, stems from improper neutralization of special elements and enables injection attacks that could lead to full remote code execution, meaning it is remotely exploitable, requires no authentication, and no user interaction.
Affected Products and Fixes
The flaws impact Cisco IOS XE Software running in autonomous or controller mode, regardless of device configuration, across releases 17.9, 17.12, 17.15, 17.18, and 26.1.
Cisco Catalyst 3650 and 3850 Series Switches were excluded from this review because they don’t run these releases; any confirmed impact on them will be patched separately.
| IOS XE Release | First Fixed Release |
|---|---|
| 17.9 | 17.9.10 |
| 17.12 | 17.12.8 |
| 17.15 | 17.15.6 |
| 17.18 | 17.18.4, 17.18.4a |
| 26.1 | 26.1.2 |
Cisco PSIRT states there is no evidence of active exploitation or public disclosure of these vulnerabilities prior to patching; this was a preemptive fix, not a response to an in-the-wild attack.
However, given the severity and network-facing nature of IOS XE deployments, threat actors are expected to reverse-engineer patches quickly once technical details become available, a pattern seen repeatedly in prior IOS XE CVEs.
Since Cisco has confirmed that no workarounds exist, immediate upgrade to the fixed releases is the only mitigation.
Network administrators running affected IOS XE versions in autonomous or controller mode should prioritize patch deployment, particularly on internet-facing or management-plane-exposed devices, given the potential for unauthenticated RCE in CVE-2026-20272.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
