Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs
Summary: Cisco released fixes for 12 vulnerabilities in Catalyst SD-WAN and IOS XE Software, including three rated 9.9 on the CVSS scale, found during internal security testing that used existing testing processes as well as frontier AI models. Cisco said the flaws are not known to be actively exploited, and separately patched a high-severity flaw in the Integrated Management Controller web interface (CVE-2026-20200, aka CIMCown) for which a proof-of-concept exploit is available.
Bottom line: The IMC flaw sits below the operating system, where an attacker with root can influence the BIOS and SecureBoot and nest deeply enough that EDR at the OS level cannot see it - and a PoC already exists. Cisco also disclosed active exploitation of CVE-2026-20316 in Secure Firewall Management Center less than a week earlier.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-20200CVE-2026-20316
- Related
- CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Known Exploited Vulnerabilities · Jul 29, 2026