Full Report
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review. The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Software when it is running in autonomous or controller mode. "These vulnerabilities were found
Analysis Summary
# Vulnerability: Cisco SD-WAN and IOS XE Multiple Critical Vulnerabilities
## CVE Details
This advisory covers 12 primary vulnerabilities. The most critical are:
- **CVE-2026-20303, CVE-2026-20304, CVE-2026-20310**: CVSS 9.9 (Critical)
- **CVE-2026-20272**: CVSS 9.8 (Critical)
- **CVE-2026-20267**: CVSS 9.0 (Critical)
- **CVE-2026-20200**: CVSS 8.8 (High)
- **CWEs**: Includes CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), CWE-284 (Improper Access Control), CWE-78 (Command Injection), and CWE-120 (Buffer Overflow).
## Affected Systems
- **Products**:
- Cisco Catalyst SD-WAN Software
- Cisco IOS XE Software
- Cisco Integrated Management Controller (IMC)
- **Versions**:
- SD-WAN: 20.9 through 20.18 and 26.1
- IOS XE: 17.9, 17.12, 17.15, 17.18, and 26.1
- **Configurations**:
- SD-WAN is affected regardless of configuration.
- IOS XE is affected when running in **autonomous** or **controller** mode.
## Vulnerability Description
The flaws were identified during an internal security review involving frontier AI models. They range from improper input validation and access control to command injection and link resolution issues.
- **SD-WAN Flaws**: Focus on path traversal and improper link resolution before file access, which could allow unauthorized system access.
- **IOS XE Flaws**: Focus on memory safety (buffer overflows), resource management (infinite loops), and command injection.
- **IMC Flaws**: Improper validation in the web-based management interface allows authenticated users to execute commands as root.
## Exploitation
- **Status**: Generally not known to be exploited in the wild. However, **CVE-2026-20200 (IMC) has a public PoC available** (hosted on GitHub).
- **Complexity**: Variable; typically Low for web-based injection.
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: Critical (Complete exposure of system data).
- **Integrity**: Critical (Unauthorized modification of system files/BIOS).
- **Availability**: Critical (Potential for total system denial of service).
## Remediation
### Patches
Cisco recommends upgrading to the following fixed releases:
- **SD-WAN**: 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, or 26.1.2.
- **IOS XE**: 17.9.10, 17.12.8, 17.15.6, 17.18.4, or 26.1.2.
- **IMC**: Updates are available for affected IMC platforms (refer to specific vendor advisory).
### Workarounds
No specific software workarounds were provided in the summary; Cisco urges immediate updates as the vulnerabilities affect the core software regardless of configuration.
## Detection
- **Indicators of Compromise**: Monitor for unusual root-level command execution or unauthorized path traversal attempts in system logs.
- **Detection methods**: Review IMC logs for suspicious authenticated sessions from low-privilege users attempting to access underlying OS shells.
## References
- Cisco SD-WAN Advisory: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K
- Cisco IOS XE Advisory: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
- IMC PoC: hxxps://github[.]com/NSIDE-ATTACK-LOGIC/CIMCown