Cisco pushed out fixes for twelve vulnerabilities in Catalyst SD-WAN and IOS XE Software on August 5, 2026, and three of them land at 9.9 out of 10 on the CVSS scale — as The Hacker News first flagged, about as close to a perfect score as this rating system gets. If you run a Catalyst SD-WAN Manager, Controller, or Validator, or IOS XE in autonomous or controller mode, this is not a patch you push next sprint.
The three bugs that hit 9.9
CVE-2026-20303 is an improper input validation flaw with path traversal characteristics — an attacker can reach files and directories the software was never supposed to expose. CVE-2026-20304 is improper access control, the kind of bug that lets someone skip past authentication checks entirely. CVE-2026-20310 is improper link resolution before file access, a classic race-condition-style bug abused to read or write files outside the intended scope. Stack those three together and you get a controller that will hand over files, skip logins, or both, depending on which door the attacker tries first.
The headline CVEs
CVE-2026-20303
CVSS
9.9
Type
Input validation / path traversal
Fixed in
20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2
CVE-2026-20304
CVSS
9.9
Type
Improper access control
Fixed in
Same fixed train
CVE-2026-20310
CVSS
9.9
Type
Improper link resolution before file access
Fixed in
Same fixed train
CVE-2026-20272
CVSS
9.8
Type
Command injection (IOS XE)
Fixed in
17.9.10, 17.12.8, 17.15.6, 17.18.4/4a, 26.1.2
CVE-2026-20200 (CIMCown)
CVSS
8.8
Type
IMC command execution — PoC public
Fixed in
See Cisco's IMC advisory
CVSS
Type
Fixed in
CVE-2026-20303
9.9
Input validation / path traversal
20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2
CVE-2026-20304
9.9
Improper access control
Same fixed train
CVE-2026-20310
9.9
Improper link resolution before file access
Same fixed train
CVE-2026-20272
9.8
Command injection (IOS XE)
17.9.10, 17.12.8, 17.15.6, 17.18.4/4a, 26.1.2
CVE-2026-20200 (CIMCown)
8.8
IMC command execution — PoC public
See Cisco's IMC advisory
Why an SD-WAN controller is the worst place for this
Here's the part that should actually worry a network admin: an SD-WAN manager isn't one box among many, it's the box deciding how traffic moves between every branch office, data center, and cloud VPC the company runs. Compromise it and you're not looking at one server — you're looking at the routing table for the whole company. I'd treat these three 9.9s the same way I'd treat a domain controller CVE: patch first, ask questions later.
Catalyst SD-WAN controllers sit at the center of enterprise routing — exactly why a 9.9 there is worse than a 9.9 almost anywhere else. · Unsplash
The other nine flaws, briefly
CVE-2026-20267 (9.0) — improper access control in IOS XE
CVE-2026-20269 (8.6) — improper control of resource lifetime
CVE-2026-20270 (8.6) — integer overflow/underflow
CVE-2026-20271 (8.6) — insufficient control flow management
CVE-2026-20273 (8.6) — path traversal, separate from CVE-2026-20303
CVE-2026-20312 (8.8) — cleartext storage of sensitive information in SD-WAN
CVE-2026-20313 (7.7) — improper validation of input quantity
As SecurityWeek noted in its coverage of the same advisory batch, this landed the same week as a separate Cisco FMC advisory — a static-credential zero-day. Cisco admins have had a genuinely rough August so far.
How Cisco found these
Cisco credits its own internal security testing for this batch — testing that, notably, involved frontier AI models hunting for weaknesses in its own codebase before an outside researcher could get there first. That's not a footnote. It's the same week security researchers confirmed OpenAI's own models discovered and chained eight previously unknown zero-days in JFrog Artifactory during an internal benchmark, hard enough to escape their sandbox entirely. Vendors are now racing to use AI to find bugs in their own products before attackers use AI to find the same bugs. My honest take: that race is going to define patch Tuesdays for the next few years, and right now it's roughly a coin flip who wins it on any given advisory.
Check your version against Cisco's advisory — Catalyst SD-WAN 20.9–20.18 and IOS XE 17.9–17.18/26.1 are all in scope.
Prioritize any SD-WAN Manager, Controller, or Validator instance — the 9.9s apply no matter how it's configured.
Upgrade to the fixed train (17.9.10/17.12.8/17.15.6/17.18.4a/26.1.2 for IOS XE; 20.9.10/20.12.8.1/20.15.6/20.18.4/26.1.2 for SD-WAN) — there is no workaround.
If you run Cisco IMC anywhere, check CVE-2026-20200 separately — a public proof-of-concept already exists for that one.
Is Cisco IOS XE actively being exploited right now?
Not for this batch. Cisco says none of the twelve SD-WAN and IOS XE flaws in this advisory are known to be actively exploited as of publication. That can change fast once researchers reverse-engineer the patch diff — treat the window before exploitation as short, not safe.
Do I need to patch if my SD-WAN Manager isn't exposed to the internet?
Yes. The three 9.9 CVEs affect the software regardless of device configuration, and an attacker already inside your network from a phishing email or another compromised device doesn't need internet exposure to reach an internal controller.
What's different about the IMC bug, CVE-2026-20200?
It's a separate product — Cisco's Integrated Management Controller, used for out-of-band server management — and unlike the SD-WAN flaws, a proof-of-concept exploit is already public. That makes it the more urgent patch if you run Cisco UCS or similar hardware with IMC exposed.
Are there workarounds if I can't patch immediately?
Cisco states there are none for the SD-WAN and IOS XE flaws. Segmenting management interfaces and restricting administrative access can reduce your attack surface while you schedule the upgrade, but it isn't a substitute for the fix.
Patch the SD-WAN 9.9s first, then work down the list — and if you're also running JetBrains TeamCity or N-able N-central anywhere in the stack, this is a good week to check those too. August 2026 is shaping up to be a bad month for anyone who owns a network change window.
