CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20303
Advisory Summary
🔷📣 Cisco PSIRT August 5, 2026—Security Advisories “Advance Notification” (Action Required)
- Cisco Catalyst SD-WAN Software Security Hardening Release (Aug 2026)
- Cisco IOS XE Software Security Hardening Release (Aug 2026)
- Cisco Integrated Management Controller (CIMC) Argument Injection
- Cisco IOS / IOS XE Extensible Messaging Client Protocol DoS
- Cisco IOS XE Extensible Exchange Protocol DoS
- Cisco IOS XE SNMP DoS
- Catalyst SD-WAN Manager Information Disclosure: CVE-2026-20294 — Medium, CVSS 6.5
- IOS XE Web-based management interface DoS: CVE-2026-20311 — Medium, CVSS 6.3
- RoomOS logging subsystem information disclosure: CVE-2026-20289 — Medium, CVSS 5.7
- Terminal Services Agent firewall rules bypass: CVE-2026-20028 — Medium, CVSS 5.0
- CIMC Cross-Site Scripting (XSS): CVE-2026-20198 — Medium, CVSS 4.8
- Validate exposure for SD-WAN and IOS XE nodes running affected code lines; stage upgrades and confirm feature compatibility.
- Confirm management interface access is restricted (ACLs/VRF separation), enforce management-plane rate limits, and ensure SNMP and web UI are not reachable from untrusted networks.
- Audit CIMC versions and management access patterns; treat argument injection and XSS as candidates for faster remediation.
- Use maintenance windows plus rollback plans; schedule verification tests for SD-WAN control connectivity and web/API management functions post-upgrade.
-WAN
Reference: Vendor Advisory