Cisco patches critical SD-WAN and IOS XE flaws with no available workarounds

Cisco released fixes for twelve flaws in Catalyst SD-WAN and IOS XE software, including three rated 9.9 and a command-injection issue rated 9.8. The three critical SD-WAN flaws, CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, stem from improper input validation, access control, and file-path handling in software that centrally controls a network. Cisco found them through internal testing that included frontier AI models and is not aware of exploitation, but there are no workarounds, so patching is the only remediation. Cisco also patched a management-controller flaw with public exploit code that lets a low-privileged user reach root.

Check

Upgrade Catalyst SD-WAN and IOS XE to the fixed releases Cisco lists, since there are no workarounds, and prioritize the management-controller flaw that already has public exploit code.

Affected

Organizations running affected Cisco Catalyst SD-WAN or IOS XE (CVE-2026-20303, CVE-2026-20304, CVE-2026-20310); the flaws affect software that centrally controls the network, and no workarounds exist.

Fix

Apply Cisco's fixed software, restrict access to network management interfaces, and treat the management-controller flaw with public proof-of-concept code as a priority since it reaches root.