Cisco Patches Seven Critical IOS XE Vulnerabilities Including CVSS 9.8 Command Injection Flaw
Cisco has issued a security update addressing seven vulnerabilities in IOS XE, the operating system used across routers, switches, wireless controllers, and other enterprise network equipment.
The most severe flaw, identified as CVE-2026-20272 and scored CVSS 9.8, involves improper handling of special elements within commands. This weakness can allow attackers to perform command injection, execute unauthorized operations, and fully compromise affected devices over the network.
Additional vulnerabilities affect memory management, resource lifecycle handling, numeric calculations, execution flow, and input validation. Potential consequences include buffer overflows, out-of-bounds writes, device crashes, infinite loops, and directory traversal attacks.
The issues impact IOS XE running in either standalone or controller-managed mode and are independent of any specific device configuration. Affected version lines include 17.9, 17.12, 17.15, 17.18, and 26.1.
Patches are available starting with versions 17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, and 26.1.2. No temporary workarounds exist that can eliminate exposure to these flaws.
The vulnerabilities were identified during internal testing, including analyses supported by advanced artificial intelligence models. As of the advisory publication, there were no indications of public exploitation or malicious use in the wild.
Related articles
NEOMSA APIM 4.6.0 Eliminates All Critical and High Vulnerabilities Registered in FSTEC BDU
Neoflex has released NEOMSA APIM 4.6.0 with a primary focus on strengthening the security of the platform's supply chain. The team generated an SBOM in CycloneDX format, scanned components and dependencies using Grype, and cross-referenced findings against the FSTEC BDU database. This process reduced total registered vulnerabilities from 57 to 7, completely removing all 10 Critical and 24 High issues. The platform now meets the formal Security Gate criterion requiring zero Critical or High vulnerabilities from the FSTEC database in the final build. Remaining Medium findings are documented and tracked for future updates. The release provides customers with a verified, transparent component inventory that simplifies compliance and integration reviews.
Cisco Publishes 12 Security Advisories Fixing Critical Flaws in Catalyst SD-WAN and IOS XE
Cisco Systems released 12 new security advisories on August 5, 2026, disclosing a total of 23 vulnerabilities across multiple products. Two advisories covering Cisco Catalyst SD-WAN Software and Cisco IOS XE Software received the highest Critical severity rating. The SD-WAN advisory addresses five issues, including CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, each scoring 9.9 on CVSSv3.1. The IOS XE advisory details seven vulnerabilities, with CVE-2026-20272 rated 9.8 and CVE-2026-20267 rated 9.0. Additional advisories cover flaws in Integrated Management Controller, RoomOS, and Terminal Services Agent. Organizations are urged to apply the hardening releases immediately to mitigate remote exploitation risks.
Head Mare Hackers Exploit TrueConf Servers to Distribute PhantomCore and PhantomGraph Backdoors
Russian organizations have been targeted in a new campaign by the Head Mare group, which compromises unpatched TrueConf servers to deliver backdoors. Attackers chain vulnerabilities KLCERT-26-057 and KLCERT-26-058 to execute arbitrary code with maximum privileges on affected servers. They then replace a server file with a web shell to explore the victim's infrastructure, access the TrueConf database, and substitute the client installer. Victims are tricked via social engineering into downloading the malicious client during video conferences without any suspicious emails. The campaign affects TrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5, and earlier releases. Kaspersky researchers recommend immediate updates to patched versions 5.3.9, 5.4.9, and 5.5.5 released on 18 June 2026. The threat extends beyond direct TrueConf users, as any employee invited to a compromised server can inadvertently install the backdoor.
Zapscape Flaw in KVM Breaks Nested Virtualization Isolation Allowing L1 Guest Root Code Execution on Linux Host
The Zapscape vulnerability (CVE-2026-64561) affects KVM/x86 in the Linux kernel and enables an attacker with kernel privileges inside an L1 virtual machine to escape to the host and execute code as root. The flaw occurs in the shadow MMU when handling page faults for nested guests, specifically due to an incorrect order of stale root condition checks that leads to a use-after-free condition. This weakens the isolation between the host and L1 guests precisely when nested virtualization is enabled for potentially untrusted tenants. A public proof-of-concept demonstrates the escape by creating a file named /Zapscape owned by root on the host. The issue impacts Linux kernels starting from version 5.9, with fixes already merged into stable branches including 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2 rc5. On Intel systems the attack requires EPT page walk lengths 4 and 5 to be exposed to the L1 guest, while no equivalent condition is documented for AMD. Organizations are advised to apply patches promptly or disable nested virtualization for untrusted workloads.