Advisories
Cisco IOS XE Hardening Release Addresses 7 Critical CVEs – August 2026
Cisco’s IOS XE team rolled out a hardening update in August 2026 that patches seven critical vulnerabilities discovered during internal testing. No workarounds exist; customers should apply the latest firmware to mitigate the risks. The CVEs span multiple CWE categories and carry a Critical impact rating.
Cisco’s IOS XE engineering squad completed an exhaustive internal security review, uncovering seven high‑severity flaws that had not yet been exploited in the wild. The company has bundled these issues by their underlying Common Weakness Enumeration (CWE) classes and assigned a single CVE identifier to each.
Key Details
- Security Impact: Critical
- Vulnerabilities: CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20272, CVE-2026-20273
- No known active exploitation; internal testing only
- No workarounds available – patching is mandatory
- Updates released for all supported IOS XE platforms
Customers are urged to download and install the latest IOS XE firmware to close these gaps. The advisory, which details the affected software versions and patch procedures, is publicly available through Cisco’s security portal.
Related vulnerabilities
Cisco Crosswork Hardening Release: Critical CVEs Uncovered in August 2026
Cisco’s Crosswork team has rolled out a hardening update after an internal security audit revealed several critical weaknesses. Four CVEs—CVE‑2026‑20030, CVE‑2026‑20357, CVE‑2026‑20358, and CVE‑2026‑20359—were patched in the new firmware, with no workarounds available. The vulnerabilities were not known to be actively exploited, but the critical rating urges immediate action. Update your Crosswork devices now to stay protected.
Read briefing
Cisco Hardens Secure Email Gateway with Critical Patch for Exploited SQL Injection
Cisco rolled out a hardening update for its Secure Email Gateway and Secure Email & Web Manager after an internal audit uncovered several critical flaws, including a live SQL injection exploit. The fix bundles five CVEs (CVE‑2026‑20353, 76440‑76443) into a single patch with no workarounds, demanding immediate action from customers to maintain email security.
Read briefing
Cisco Catalyst SD‑WAN Hardening Update: Critical Vulnerabilities Resolved (CVE‑2026‑20303‑20313)
Cisco’s SD‑WAN software team released a hardening patch in August 2026 after an internal audit uncovered several critical weaknesses. Five CVEs—CVE‑2026‑20303, ‑20304, ‑20310, ‑20312, ‑20313—were addressed through a single update per CWE class. No workarounds exist, so all Catalyst SD‑WAN customers should apply the new releases immediately to close the gaps.
Read briefing
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing