Cisco Patches Critical IOS XE and FMC Flaws With CVSS Scores Up to 10
Security updates address high-severity vulnerabilities that could allow unauthenticated remote attackers to compromise enterprise networking hardware.
Cisco released a series of critical security updates in August 2026 to address multiple vulnerabilities in its IOS XE Software and Secure Firewall Management Center (FMC). These flaws could allow unauthenticated remote attackers to gain unauthorized access or execute code on affected devices.
Among the most severe is CVE-2026-20079, a vulnerability in the Cisco FMC web interface with a maximum CVSS score of 10.0. According to VulnCheck, this authentication bypass flaw can lead to remote code execution. Within the IOS XE Software, CVE-2026-20272 was identified as a critical vulnerability with a CVSS score of 9.8, involving command, OS, and argument injection (CWE-74). Other notable IOS XE flaws include CVE-2026-20267, which carries a CVSS score of 9.0 due to improper access control, and a cluster of vulnerabilities (CVE-2026-20268 through CVE-2026-20273) each rated 8.6.
Infrastructure at Risk
The vulnerabilities in IOS XE are particularly concerning because they affect the software in both autonomous and controller modes. According to reports from The Hacker News and GBhackers, the flaws persist regardless of the specific device configuration, meaning a wide array of enterprise hardware is potentially exposed. IOS XE serves as the foundational operating system for a vast portion of global enterprise networking infrastructure, including the software-defined wide area networking (SD-WAN) capabilities that manage traffic across corporate sites.
Industry Implications
With CVSS scores reaching 9.8 and 10.0, these vulnerabilities represent a severe risk to network integrity. Because the flaws can be exploited by unauthenticated remote attackers, they could lead to full device takeover, massive data breaches, or network-wide outages. The severity is compounded by the fact that there are no available workarounds for these issues, leaving immediate software upgrades as the only viable defense for administrators.
Current Status
Cisco reported that there was no known public disclosure or active malicious exploitation of these vulnerabilities at the time the patches were published. Organizations are urged to apply the updates immediately to prevent potential attacks. While one report from GBhackers suggested the flaws were discovered using advanced AI models and internal testing, this specific detail regarding the discovery process has not been independently verified by other security outlets.