{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ucs-c-series-m7-rack-servers/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9,"id":"CVE-2026-20267"},{"cvss":9.8,"id":"CVE-2026-20272"},{"cvss":9.1,"id":"CVE-2026-20310"},{"cvss":8.8,"id":"CVE-2026-20200"},{"cvss":8.6,"id":"CVE-2026-20263"},{"cvss":8.6,"id":"CVE-2026-20268"},{"cvss":8.6,"id":"CVE-2026-20269"},{"cvss":8.6,"id":"CVE-2026-20273"},{"cvss":8.6,"id":"CVE-2026-20301"},{"cvss":8.8,"id":"CVE-2026-20312"},{"cvss":7.7,"id":"CVE-2026-20313"},{"cvss":6.3,"id":"CVE-2026-20311"},{"cvss":4.8,"id":"CVE-2026-20198"},{"cvss":9.9,"id":"CVE-2026-20303"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["IOS XE Software","Catalyst SD-WAN","Integrated Management Controller","IOS Software","RoomOS","Catalyst SD-WAN Manager","Terminal Services Agent","IOS XE","Secure Firewall Management Center","IOS","Terminal Service Agent","UCS C-Series M7 Rack Servers","UCS C-Series M8 Rack Servers"],"_cs_severities":["high"],"_cs_tags":["roundup"],"_cs_type":"threat","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eThis roundup covers 19 Cisco security vulnerabilities. None are reported as actively exploited at the time of release. The issues affect Catalyst SD-WAN, Catalyst SD-WAN Manager, IOS Software, IOS XE Software, Integrated Management Controller, RoomOS, Terminal Services Agent.\u003c/p\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n\t\u003cthead\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003cth\u003eCVE\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eCVSS\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eProduct\u003c/th\u003e\n\t\t\t\t\t\u003cth\u003eSummary\u003c/th\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/thead\u003e\n\t\u003ctbody\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20267\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e9.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco IOS XE Software contains multiple internally discovered vulnerabilities characterized by improper access control (CWE-284). These vulnerabilities were identified during an internal security review and addressed through software hardening releases, carrying a CVSS base score of 9.0.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20272\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e9.8\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20272 represents a critical vulnerability in Cisco IOS XE Software, identified through internal security reviews as an issue involving improper neutralization of special elements, classified under CWE-74. With a CVSS base score of 9.8, the vulnerability allows for potential remote command injection, requiring immediate patching as part of Cisco's software hardening releases.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20310\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e9.1\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCatalyst SD-WAN\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco Catalyst SD-WAN is affected by a vulnerability (CVE-2026-20310) resulting from improper link resolution before file access, categorized as CWE-59. This internally discovered issue prompted security hardening updates for the affected platform.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20124\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20124 is a denial of service vulnerability in the SNMP subsystem of Cisco IOS XE Software. An authenticated remote attacker with valid SNMP community strings (v1/v2c) or credentials (v3) can send a malformed SNMP request, causing the device to unexpectedly reload. Detection should focus on monitoring SNMP request traffic for anomalies or malformed packets targeting the SNMP subsystem.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20200\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.8\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIntegrated Management Controller\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco IMC contains a vulnerability in its web-based management interface stemming from improper input validation. An authenticated remote attacker with low privileges can leverage this flaw to perform command injection, resulting in the execution of arbitrary commands with root-level privileges on the underlying operating system.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20263\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.6\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software allows unauthenticated remote attackers to trigger a device reload via a crafted BEEP SOAP request, resulting in a denial-of-service (DoS) condition.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20268\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.6\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco IOS XE Software contains vulnerabilities related to improper restriction of operations within the bounds of a memory buffer, categorized under CWE-119. These issues were discovered during an internal security review and addressed via software hardening releases, carrying a CVSS v3.1 base score of 8.6.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20269\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.6\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco IOS XE Software contains multiple internally discovered vulnerabilities related to improper control of a resource through its lifetime, classified under CWE-664. These issues were identified during a proactive internal security review and have been addressed in software hardening releases.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20271\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco IOS XE Software contains multiple vulnerabilities related to insufficient control flow management, categorized under CWE-691. These vulnerabilities were identified through an internal security review, and Cisco has released software updates to address the underlying issues.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20273\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.6\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20273 refers to an improper input validation vulnerability (CWE-20) in Cisco IOS XE Software. With a CVSS base score of 8.6, this vulnerability is exploitable remotely by an unauthenticated attacker, potentially leading to a denial-of-service condition (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20301\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e8.6\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA vulnerability in the Extensible Messaging Client Protocol (XMCP) implementation within Cisco IOS and IOS XE software allows unauthenticated, remote attackers to trigger a device reload via malformed packets, resulting in a denial-of-service condition.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20312\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCatalyst SD-WAN\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco Catalyst SD-WAN software contains a vulnerability identified as CVE-2026-20312 involving the cleartext storage of sensitive information, classified under CWE-312. This vulnerability was identified during an internal security review and addressed through a software hardening release.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20313\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e7.7\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCatalyst SD-WAN\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCisco Catalyst SD-WAN is affected by a vulnerability involving improper link resolution before file access, categorized under CWE-1284. This vulnerability was identified during an internal security review and addressed via software hardening releases.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20311\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e6.3\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA vulnerability in the web-based management interface of Cisco IOS XE Software allows an authenticated, low-privileged remote attacker to trigger a denial-of-service condition. By submitting a malformed certificate to the interface, an attacker can cause the device to reload, resulting in an unexpected service disruption. Cisco has released software updates to address this flaw.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20198\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIntegrated Management Controller\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA cross-site scripting (XSS) vulnerability exists in the web-based management interface of the Cisco Integrated Management Controller due to improper input validation. An authenticated remote attacker can exploit this by convincing a user to interact with a malicious link, potentially leading to arbitrary script execution within the victim's browser context.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20289\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eRoomOS\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA vulnerability in the logging subsystem of Cisco RoomOS allows an authenticated, local attacker with low privileges to access sensitive information, such as user login credentials, by enabling specific logging levels and accessing system logs. There are no workarounds available, and patching is required.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20294\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eCatalyst SD-WAN Manager\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eAn information disclosure vulnerability exists in the web-based management interface of Cisco Catalyst SD-WAN Manager due to insufficient access control on specific template types. Authenticated attackers with low privileges can exploit this to view sensitive authentication credentials in clear text within local or remote logs, potentially leading to escalation of privilege and further infrastructure compromise.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20028\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eTerminal Services Agent\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eA vulnerability in the Cisco Terminal Services Agent network driver allows an authenticated remote attacker with user-level credentials to bypass firewall rules by incorrectly mapping network connections to user accounts, effectively inheriting the firewall policy of another user.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\t\t\u003ctr\u003e\n\t\t\t\t\t\u003ctd\u003eCVE-2026-20308\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003e0.0\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eIOS XE Software\u003c/td\u003e\n\t\t\t\t\t\u003ctd\u003eAn authenticated remote attacker with low privileges can trigger a denial of service (DoS) condition in the web-based management interface of Cisco IOS XE Software by sending crafted input, resulting in the interface becoming unresponsive due to insufficient input validation.\u003c/td\u003e\n\t\t\t\u003c/tr\u003e\n\t\u003c/tbody\u003e\n\u003c/table\u003e\n\u003ch2 id=\"cve-2026-20267\"\u003eCVE-2026-20267\u003c/h2\u003e\n\u003cp\u003eCisco IOS XE Software contains multiple internally discovered vulnerabilities characterized by improper access control (CWE-284). These vulnerabilities were identified during an internal security review and addressed through software hardening releases, carrying a CVSS base score of 9.0.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20267\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20267\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20272\"\u003eCVE-2026-20272\u003c/h2\u003e\n\u003cp\u003eCVE-2026-20272 represents a critical vulnerability in Cisco IOS XE Software, identified through internal security reviews as an issue involving improper neutralization of special elements, classified under CWE-74. With a CVSS base score of 9.8, the vulnerability allows for potential remote command injection, requiring immediate patching as part of Cisco's software hardening releases.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20272\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20272\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20310\"\u003eCVE-2026-20310\u003c/h2\u003e\n\u003cp\u003eCisco Catalyst SD-WAN is affected by a vulnerability (CVE-2026-20310) resulting from improper link resolution before file access, categorized as CWE-59. This internally discovered issue prompted security hardening updates for the affected platform.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCatalyst SD-WAN\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20310\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20310\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20124\"\u003eCVE-2026-20124\u003c/h2\u003e\n\u003cp\u003eCVE-2026-20124 is a denial of service vulnerability in the SNMP subsystem of Cisco IOS XE Software. An authenticated remote attacker with valid SNMP community strings (v1/v2c) or credentials (v3) can send a malformed SNMP request, causing the device to unexpectedly reload. Detection should focus on monitoring SNMP request traffic for anomalies or malformed packets targeting the SNMP subsystem.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20124\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20124\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20200\"\u003eCVE-2026-20200\u003c/h2\u003e\n\u003cp\u003eCisco IMC contains a vulnerability in its web-based management interface stemming from improper input validation. An authenticated remote attacker with low privileges can leverage this flaw to perform command injection, resulting in the execution of arbitrary commands with root-level privileges on the underlying operating system.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIntegrated Management Controller\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20200\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20200\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20263\"\u003eCVE-2026-20263\u003c/h2\u003e\n\u003cp\u003eA vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software allows unauthenticated remote attackers to trigger a device reload via a crafted BEEP SOAP request, resulting in a denial-of-service (DoS) condition.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20263\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20263\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20268\"\u003eCVE-2026-20268\u003c/h2\u003e\n\u003cp\u003eCisco IOS XE Software contains vulnerabilities related to improper restriction of operations within the bounds of a memory buffer, categorized under CWE-119. These issues were discovered during an internal security review and addressed via software hardening releases, carrying a CVSS v3.1 base score of 8.6.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20268\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20268\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20269\"\u003eCVE-2026-20269\u003c/h2\u003e\n\u003cp\u003eCisco IOS XE Software contains multiple internally discovered vulnerabilities related to improper control of a resource through its lifetime, classified under CWE-664. These issues were identified during a proactive internal security review and have been addressed in software hardening releases.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20269\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20269\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20271\"\u003eCVE-2026-20271\u003c/h2\u003e\n\u003cp\u003eCisco IOS XE Software contains multiple vulnerabilities related to insufficient control flow management, categorized under CWE-691. These vulnerabilities were identified through an internal security review, and Cisco has released software updates to address the underlying issues.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20271\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20271\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20273\"\u003eCVE-2026-20273\u003c/h2\u003e\n\u003cp\u003eCVE-2026-20273 refers to an improper input validation vulnerability (CWE-20) in Cisco IOS XE Software. With a CVSS base score of 8.6, this vulnerability is exploitable remotely by an unauthenticated attacker, potentially leading to a denial-of-service condition (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20273\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20273\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20301\"\u003eCVE-2026-20301\u003c/h2\u003e\n\u003cp\u003eA vulnerability in the Extensible Messaging Client Protocol (XMCP) implementation within Cisco IOS and IOS XE software allows unauthenticated, remote attackers to trigger a device reload via malformed packets, resulting in a denial-of-service condition.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS Software\u003c/li\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20301\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20301\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20312\"\u003eCVE-2026-20312\u003c/h2\u003e\n\u003cp\u003eCisco Catalyst SD-WAN software contains a vulnerability identified as CVE-2026-20312 involving the cleartext storage of sensitive information, classified under CWE-312. This vulnerability was identified during an internal security review and addressed through a software hardening release.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCatalyst SD-WAN\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20312\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20312\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20313\"\u003eCVE-2026-20313\u003c/h2\u003e\n\u003cp\u003eCisco Catalyst SD-WAN is affected by a vulnerability involving improper link resolution before file access, categorized under CWE-1284. This vulnerability was identified during an internal security review and addressed via software hardening releases.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCatalyst SD-WAN\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-20313\"\u003ehttps://nvd.nist.gov/vuln/detail/CVE-2026-20313\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20311\"\u003eCVE-2026-20311\u003c/h2\u003e\n\u003cp\u003eA vulnerability in the web-based management interface of Cisco IOS XE Software allows an authenticated, low-privileged remote attacker to trigger a denial-of-service condition. By submitting a malformed certificate to the interface, an attacker can cause the device to reload, resulting in an unexpected service disruption. Cisco has released software updates to address this flaw.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-PtAODAWW?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XE%20Software%20Web-Based%20Management%20Interface%20Denial%20of%20Service%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-PtAODAWW?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XE%20Software%20Web-Based%20Management%20Interface%20Denial%20of%20Service%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20198\"\u003eCVE-2026-20198\u003c/h2\u003e\n\u003cp\u003eA cross-site scripting (XSS) vulnerability exists in the web-based management interface of the Cisco Integrated Management Controller due to improper input validation. An authenticated remote attacker can exploit this by convincing a user to interact with a malicious link, potentially leading to arbitrary script execution within the victim's browser context.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIntegrated Management Controller\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Integrated%20Management%20Controller%20Cross-Site%20Scripting%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Integrated%20Management%20Controller%20Cross-Site%20Scripting%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20289\"\u003eCVE-2026-20289\u003c/h2\u003e\n\u003cp\u003eA vulnerability in the logging subsystem of Cisco RoomOS allows an authenticated, local attacker with low privileges to access sensitive information, such as user login credentials, by enabling specific logging levels and accessing system logs. There are no workarounds available, and patching is required.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRoomOS\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-infodisc-qBXjfmWm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20RoomOS%20Logging%20Subsystem%20Information%20Disclosure%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-infodisc-qBXjfmWm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20RoomOS%20Logging%20Subsystem%20Information%20Disclosure%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20294\"\u003eCVE-2026-20294\u003c/h2\u003e\n\u003cp\u003eAn information disclosure vulnerability exists in the web-based management interface of Cisco Catalyst SD-WAN Manager due to insufficient access control on specific template types. Authenticated attackers with low privileges can exploit this to view sensitive authentication credentials in clear text within local or remote logs, potentially leading to escalation of privilege and further infrastructure compromise.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCatalyst SD-WAN Manager\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-SPuJBDCe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20Information%20Disclosure%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-infodis-SPuJBDCe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20Information%20Disclosure%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20028\"\u003eCVE-2026-20028\u003c/h2\u003e\n\u003cp\u003eA vulnerability in the Cisco Terminal Services Agent network driver allows an authenticated remote attacker with user-level credentials to bypass firewall rules by incorrectly mapping network connections to user accounts, effectively inheriting the firewall policy of another user.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eTerminal Services Agent\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrev?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Terminal%20Services%20Agent%20Firewall%20Rules%20Bypass%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrev?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Terminal%20Services%20Agent%20Firewall%20Rules%20Bypass%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n\u003ch2 id=\"cve-2026-20308\"\u003eCVE-2026-20308\u003c/h2\u003e\n\u003cp\u003eAn authenticated remote attacker with low privileges can trigger a denial of service (DoS) condition in the web-based management interface of Cisco IOS XE Software by sending crafted input, resulting in the interface becoming unresponsive due to insufficient input validation.\u003c/p\u003e\n\u003cp\u003eAffected products:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIOS XE Software\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eSource: \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XE%20Software%20Web-Based%20Management%20Interface%20Denial%20of%20Service%20Vulnerability%26vs_k=1\"\u003ehttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XE%20Software%20Web-Based%20Management%20Interface%20Denial%20of%20Service%20Vulnerability%26vs_k=1\u003c/a\u003e\u003c/p\u003e\n","date_modified":"2026-08-06T07:34:37Z","date_published":"2026-08-05T17:20:12Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cisco-security-updates/","summary":"Roundup of Cisco security advisories published in August 2026.","title":"Cisco Security Updates - August 2026","url":"https://feed.craftedsignal.io/briefs/2026-08-cisco-security-updates/"}],"language":"en","title":"CraftedSignal Threat Feed - UCS C-Series M7 Rack Servers","version":"https://jsonfeed.org/version/1.1"}