Cisco Patches 12 Critical Catalyst SD-WAN and IOS XE Flaws: CVE-2026-20272 Command Injection Scores CVSS 9.8
On 7 August Cisco shipped a coordinated fix for 12 high-severity Catalyst SD-WAN and IOS XE flaws. CVE-2026-20303/20304/20310 score 9.9; CVE-2026-20272 is command injection at 9.8. A public PoC exists for IMC CVE-2026-20200.
On 7 August 2026 Cisco published a coordinated security advisory covering 12 vulnerabilities across Catalyst SD-WAN, IOS XE Software, and Integrated Management Controller (IMC). The set includes CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310 — three input-validation defects at CVSS 9.9 — plus IOS XE command injection CVE-2026-20272 (CVSS 9.8). Cisco said the issues were found with a mix of traditional testing and frontier AI models, and stated that no in-the-wild exploitation had been observed at advisory time.
Incident Overview
The patched bugs span command injection, buffer overflow, integer errors, improper input validation, path traversal, and plaintext storage of sensitive data. It is Cisco's third large network-OS patch cycle in two years. SD-WAN controllers, IOS XE devices, and IMC server web management interfaces sit at privileged points in enterprise networks. Compromise hits connectivity, management plane, and the underlying OS.
Technical Details
- CVE-2026-20303 (CVSS 9.9): Catalyst SD-WAN improper input validation, including path traversal.
- CVE-2026-20304 (CVSS 9.9): Catalyst SD-WAN improper access control.
- CVE-2026-20310 (CVSS 9.9): Catalyst SD-WAN improper link resolution before file access.
- CVE-2026-20312 (CVSS 8.8): plaintext storage of sensitive information on SD-WAN.
- CVE-2026-20267 (CVSS 9.0): IOS XE improper access control.
- CVE-2026-20268/20269/20270/20271/20273 (CVSS 8.6): out-of-bounds write, resource-lifetime issues, numeric errors, control-flow, and improper input validation.
- CVE-2026-20272 (CVSS 9.8): IOS XE command injection. Affects all 17.9–26.1 versions running in autonomous or controller mode.
- CVE-2026-20200 (CVSS 8.8): IMC Web UI improper input validation. A low-privilege authenticated remote user can run commands on the underlying OS and escalate to root. A public PoC is out.
- CVE-2026-20288 (CVSS 6.5): similar IMC Web UI command injection; requires admin privileges.
Impact Assessment
- CVSS range: clustered 8.5–9.9. The three 9.9 scores are all SD-WAN.
- SD-WAN: all major releases 20.9–26.1. Controllers are commonly on the enterprise backbone.
- IOS XE: branches 17.9 / 17.12 / 17.15 / 17.18 / 26.1, covering mainstream routers and switches.
- Exploitation: CVE-2026-20200 PoC is public, so IMC moved from "no in-the-wild use" to "ready to be exploited."
- Threat profile: SD-WAN/IOS XE have historically been high-priority targets for nation-state actors. Compromise of the FMC (Secure Firewall Management Center) management plane can hide policy changes.
Remediation
- Patch now. SD-WAN: 20.9.10 / 20.12.8.1 / 20.15.6 / 20.18.4 / 26.1.2. IOS XE: 17.9.10 / 17.12.8 / 17.15.6 / 17.18.4 (or 17.18.4a) / 26.1.2. IMC: versions listed in Cisco's advisory.
- Prioritize IMC. Because the CVE-2026-20200 PoC is public, patch IMC firmware first and do not leave the Web UI broadly reachable.
- Network isolation. Confine the SD-WAN management plane, IOS XE management ports, and IMC Web UI to an out-of-band management VLAN. Block direct reachability from the production network and the internet.
- Credentials and logs. After the SD-WAN fix, rotate any credentials that may have been stored in plaintext. Audit IMC Web UI command execution, file transfer, and privilege-escalation events.
- Detection. Put WAF/IDS rules on internet-facing SD-WAN/IOS XE management traffic. Watch for anomalous config changes and new admin accounts.
- Legacy: SD-WAN branches older than 20.9 no longer receive patches. Migrate to a supported branch.
References
- Cisco Security Advisory: Catalyst SD-WAN / IOS XE hardening
- The Hacker News: analysis of 12 SD-WAN / IOS XE vulnerabilities
- HackWire: severity assessment of CVE-2026-20272 and related issues
- WA SOC companion advisory