This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Cisco fixes 16 vulnerabilities in various products

Cisco fixes 16 vulnerabilities in 6 products [1][2][3][4][5][6][7][8][9]. The most severe vulnerabilities are listed below, the remaining ones affect only Cisco IOS XE and can be found at [5][7][8][9]. Cisco Integrated Management Controller (IMC) - fixed versions for the individual products containing Cisco IMC can be found at [1][4] Cisco RoomOS - 26.7.2.2 [2] Cisco Catalyst SD-WAN Manager - 20.9.10, 20.12.8, 20.15.6, 20.18.4, 26.1.2, 26.2.1 [3] Cisco IOS and IOS XE - fix availability can be checked with the Cisco Software Checker tool [10]

Cisco Integrated Management Controller - XSS (CVE-2026-20198)
CVSS 4.8 (Medium)

An authenticated remote attacker can carry out an XSS attack in the management web interface of Cisco Integrated Management Controller [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2026-20198 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2026.

Cisco RoomOS - sensitive information disclosure (CVE-2026-20289)
CVSS 5.0 (Medium)

An authenticated local attacker can obtain sensitive information, such as user credentials, from logs in Cisco RoomOS. The vulnerability is exploitable only if extended logging is enabled, or if the attacker is able to enable it [2].

The vulnerability is present in product:

  • Cisco RoomOS; <11; >=26.0, <26.7.2.2;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 5. 8. 2026.

Cisco Catalyst SD-WAN Manager - sensitive information disclosure (CVE-2026-20294)
CVSS 6.5 (Medium)

An authenticated remote attacker can obtain sensitive information, such as user credentials, in Cisco Catalyst SD-WAN Manager from logs on the local system or on a remote logging server [3].

The vulnerability is present in product:

  • Cisco Catalyst SD-WAN Manager; >=20.9, <20.9.10; >=20.10, <20.12.8; >=20.13, <20.15.6; >=20.16, <20.18.4; >=26.1, <26.1.2; >=26.2, <26.2.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 5. 8. 2026.

Cisco Integrated Management Controller - command injection (CVE-2026-20200)
CVSS 8.8 (High)

An authenticated remote attacker can execute commands in the operating system of the affected machine with root privileges in Cisco Integrated Management Controller [4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 5. 8. 2026.

Cisco IOS XE - command injection (CVE-2026-20272)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute commands in Cisco IOS XE [5].

The vulnerability is present in product:

  • Cisco IOS XE; >=17.9, <17.9.10; >=17.12, <17.12.8; >=17.15, <17.15.6; >=17.18, <17.18.4; >=26.1, <26.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-20272 at cve.org, NVD
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 8. 2026.

Cisco IOS (XE) - DoS (CVE-2026-20301)
CVSS 8.6 (High)

An unauthenticated remote attacker can carry out a DoS attack in Cisco IOS and IOS XE by sending XMCP packets. Exploiting the vulnerability does not require knowing the username of the XMCP client [6].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 5. 8. 2026.

By CESNET, z.s.p.o. Martin Krajči on 6. 8. 2026.

CESNET, z.s.p.o. Logo