CVE-2026-20272: Cisco IOS XE Command Injection CVSS 9.8; Self-Audit Finds 7 High-Severity Flaws Patched Together

Cisco published IOS XE software hardening advisory cisco-sa-hardening-iosxe-V8NMuMZJ on 5 August 2026. CVE-2026-20272 command injection leads at CVSS 9.8, covering 7 CVEs across CWE-74/CWE-119/CWE-284 and others; affects 17.9 through 17.18 and the 26.1 branch; no workaround; upgrade required.

On 5 August 2026, Cisco published the Cisco IOS XE Software Security Hardening Release advisory (`cisco-sa-hardening-iosxe-V8NMuMZJ`). Cisco PSIRT identified 7 CWE classes and 7 high-severity CVEs in an internal security review. CVE-2026-20272, a command-injection flaw, leads at CVSS v3.1 9.8. It maps to CWE-74 (Improper Neutralization of Special Elements) and lets an unauthenticated remote attacker fully compromise confidentiality, integrity, and availability of affected IOS XE devices with no credentials and no user interaction.

Incident overview

Disclosure came from a CWE-class internal hardening review by Cisco PSIRT and the IOS XE platform engineering team. Goal was class-level fixes, not per-use-case patches. Covered CWEs: CWE-284 access control, CWE-119 memory bounds, CWE-664 resource lifecycle, CWE-682 calculation error, CWE-691 control flow, CWE-74 injection, and CWE-20 input validation — mapped to CVE-2026-20267 through CVE-2026-20273. Audit used existing internal test processes and, for the first time, frontier AI models for analysis assistance.

Affected devices cover nearly all currently supported IOS XE trains:

• 17.9 → 17.9.10

• 17.12 → 17.12.8

• 17.15 → 17.15.6

• 17.18 → 17.18.4 / 17.18.4a

• 26.1 (new train) → 26.1.2

Training trains from 16.6.2 through 17.18.x and 26.1.x are in scope. Catalyst 3650 / 3850 versions were not in this review; Cisco will cover them in a later advisory.

Technical details

CVE-2026-20272 is improper neutralization of special elements in output to a downstream component: command injection, OS command injection, and argument injection. Attack vector: network, low complexity, no privileges, no user interaction, unchanged scope — the most severe CVSS combination.

Reachability:

• Attacker reaches the device over the network via Web UI, SNMP, NETCONF, RESTCONF, SSH, or other IOS XE management-plane interfaces;

• Unauthenticated crafted input is injected into config orchestration, log parsing, or session-handling paths;

• Downstream components (Shell / Config Engine / Telemetry Pipeline) treat the data as commands;

• Yields arbitrary config change, privileged account creation, or service restart; potential full device takeover.

The same advisory covers six additional CVEs including CVE-2026-20267 (CWE-284, improper access control, CVSS 9.0) and CVE-2026-20268 (CWE-119, memory bounds, CVSS 8.6). Together they harden the IOS XE kernel across access control, memory safety, resource lifecycle, integer arithmetic, control flow, and input validation. Cisco states there is no workaround and no alternative; software upgrade is required.

Impact assessment

IOS XE is the control plane for Cisco Catalyst switches, ISR/ASR routers, industrial Ethernet, and SD-WAN edge devices. This advisory effectively covers a full generation of IOS XE deployments. Risk dimensions:

• Critical infrastructure: carrier backbone, SD-WAN edge, and industrial switches widely run IOS XE. Affected trains span a wide range; the flaws are remotely exploitable.

• Management-plane exposure: many orgs still expose IOS XE Web UI / SSH on management networks or VPN ingress. CVE-2026-20272 is usable for lateral movement from a compromised jump host.

• No public PoC yet, short exploit window: not on CISA KEV; no public exploit / PoC observed. Crowdstrike 2026 reporting notes public exploits are typically weaponized within 48 hours. Combined with access-control defects alongside CVE-2026-20267, exploitation likelihood is high.

• Same-day SD-WAN overlay: 5 August also disclosed SD-WAN branch software hardening and multiple independent CVEs. Ops change windows must merge two upgrade tracks.

Remediation

• Emergency upgrade: move all IOS XE devices on their current train to 17.9.10 / 17.12.8 / 17.15.6 / 17.18.4 (or 17.18.4a) / 26.1.2. Use Cisco's official Fixed Software table for the exact image.

• No workaround: Cisco lists none. Do not substitute service disablement for an upgrade. This is kernel-level hardening; version upgrade is required.

• Constrain management plane: restrict SSH / NETCONF / RESTCONF / HTTPS to the internal management network (Infra ACL / CoPP / control-plane policing). Enable TACACS / RADIUS + AAA centralized audit.

• Credential and config audit: after upgrade, rotate enable secret / local user passwords / SSH keys; audit AAA / RADIUS shared secrets and IKE PSKs. Diff running-config pre/post upgrade with drift tooling for unexpected accounts, ACL edits, route-map changes.

• Detection and rollback: alert in SIEM / logging on IOS XE logins from unusual IPs, anomalous enable command streams, and NETCONF / RESTCONF calls outside normal windows. Full backup of device config / images before upgrade for 24-hour rollback.

References

• Cisco Security Advisory IOS XE Software Security Hardening Release: August 2026

• NVD CVE-2026-20272 (CVSS 9.8)

• GitHub Advisory GHSA-cgmj-4p58-cx74

• IntelFusions Cisco patches critical IOS XE flaws it found itself

• KKM Mako Cisco IOS XE: Ten Flaws, No Workarounds, Fixes in 17.9.10 and Later