Cisco Patches 12 Critical Flaws, But Three 9.9s Demand Your Attention

Robert Moore · 2026-08-06

Cisco just dropped a wave of security updates, and if you're running Catalyst SD-WAN or IOS XE, you'll want to pay attention. This isn't your typical patch Tuesday—we're talking about a dozen vulnerabilities, including three that scored a near-perfect 9.9 on the CVSS scale. That's about as close to a worst-case scenario as it gets. These flaws were discovered during an internal security review, which is actually a good sign. It means Cisco found them before the bad guys did. But that doesn't mean you can drag your feet on this one. Let's break down what's at stake and why these updates should jump to the top of your to-do list. ### What's Actually Affected? The security issues hit two main product lines, and here's the kicker—one of them is vulnerable regardless of how you've configured it. That's a big deal because it removes the "well, I set it up differently" excuse from the table. - **Cisco Catalyst SD-WAN Software**: Affected in every configuration. If you're running this, you're exposed. - **Cisco IOS XE Software**: Affected when running in either autonomous or controller mode. That covers most enterprise deployments. In plain English? If you're using these products, you need to patch. There's no workaround that magically makes you immune. ### Why a 9.9 CVSS Score Should Scare You For context, CVSS scores run from 0 to 10. A 9.9 isn't just "high severity"—it's borderline catastrophic. These aren't theoretical issues that require a hacker to be standing in your server room with a USB drive. We're talking about vulnerabilities that could potentially be exploited remotely, which is the nightmare scenario for any network admin. Think of it like this: your network is a house, and these flaws are unlocked doors. A 9.9 score means the door isn't just unlocked—it's wide open, with a neon sign pointing right at it. You wouldn't leave your front door like that, so don't leave your network exposed either. ### The "We Found It First" Silver Lining Here's the thing that should give you a little peace of mind: Cisco's internal review found these issues. That's not luck—it's a sign that their security processes are actually working. They're actively hunting for flaws before they become public knowledge, which is exactly what you want from a vendor handling critical infrastructure. But here's the catch: now that the patches are public, the window for attackers to reverse-engineer the fixes and target unpatched systems is wide open. This is the most dangerous time. Every day you delay is a day someone could be probing your network for these exact weaknesses. ### What You Should Do Right Now Don't wait for the quarterly maintenance window. Don't wait for your team to "get around to it." This is a drop-everything-and-patch situation. - **Check your inventory**: Identify every device running Catalyst SD-WAN or IOS XE in autonomous or controller mode. - **Prioritize the 9.9s**: If you can't patch everything at once, start with the three critical flaws. They're the ones that'll keep you up at night. - **Test in a staging environment**: If possible, validate the patches before rolling them out to production. But don't let testing become an excuse for endless delays. - **Monitor your logs**: After patching, keep an eye on your network for any unusual activity. Just because you've fixed the hole doesn't mean someone didn't already sneak in. ### The Bottom Line Cisco's internal review caught these issues before they became public exploits, and that's genuinely good news. But the clock is ticking. With three 9.9s in the mix, this isn't a patch you can postpone. Take a deep breath, grab your coffee, and get to work. Your network—and your sleep schedule—will thank you.