Cisco IOS XE patches multiple security bypass flaws
ANSSI advisory details seven Cisco IOS XE vulnerabilities allowing security policy bypass and unspecified issues, fixed in updated releases.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French national cybersecurity agency (ANSSI/CERT-FR) issued an advisory summarizing a Cisco security bulletin covering seven vulnerabilities (CVE-2026-20267 through CVE-2026-20273) in Cisco IOS XE Software. The flaws allow an attacker to bypass security policy controls and trigger other unspecified security issues; Cisco's advisory does not detail the exact mechanisms or impact beyond these categories.
Affected versions span multiple IOS XE branches: 17.9.x before 17.9.10, 17.12.x before 17.12.8, 17.15.x before 17.15.6, 17.18 before 17.18.4/17.18.4a, and 26.1.x before 26.1.2. Cisco has released patched versions addressing these issues, and organizations running affected IOS XE releases should apply the vendor fixes referenced in the Cisco security advisory (cisco-sa-hardening-iosxe-V8NMuMZJ). No indication of active exploitation is provided in this advisory; it is a standard vendor patch notification relayed by ANSSI.
Defenders operating Cisco IOS XE devices should inventory affected versions and prioritize patching per standard vulnerability management processes, particularly given the network infrastructure role these devices typically play.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1077
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs