Cisco's Latest Patch Wave Fixes 12 Flaws—Three Hit the Maximum Severity

Michael Miller · 2026-08-06

Cisco just dropped a significant round of security updates, and if you're running any of their SD-WAN or IOS XE gear, you'll want to pay close attention. The company patched a dozen vulnerabilities in Catalyst SD-WAN and IOS XE Software, and three of them carry the dreaded 9.8 CVSS score—basically the worst rating you can get short of a full system compromise. That's not the kind of news you want to skim past. These flaws were discovered during an internal security review, which means Cisco found them before attackers could exploit them in the wild. Still, the clock is ticking now that patches are public—malicious actors will be reverse-engineering the fixes to find vulnerable systems. ### What Exactly Is Affected? Here's the tricky part: the affected software spans a wide range of deployments. Let's break it down: - **Cisco Catalyst SD-WAN Software**—vulnerable regardless of device configuration. That's a big deal because it means even well-hardened setups are at risk. - **Cisco IOS XE Software**—but only when running in autonomous or controller mode. So if you're using IOS XE in either of those modes, you're in the crosshairs. The fact that Catalyst SD-WAN is affected "regardless of device configuration" is particularly concerning. It suggests the vulnerability lives deep in the core code, not in some optional feature you could disable. ### Why a 9.8 CVSS Score Should Scare You For those who aren't deep in the cybersecurity weeds, the CVSS (Common Vulnerability Scoring System) goes from 0 to 10. A 9.8 is about as severe as it gets. To put that in perspective, these are vulnerabilities that could allow an attacker to gain complete control over affected devices without any authentication. Think of it this way: if your SD-WAN controller is compromised, an attacker isn't just messing with one router. They're potentially controlling your entire network's traffic flow, redirecting data, or injecting malicious payloads into your infrastructure. That's the kind of breach that keeps network admins up at night. ### What Should You Do Right Now? If you're running any affected Cisco equipment, here's your action plan: 1. **Check your device models and software versions** against Cisco's advisory to confirm whether you're exposed. 2. **Download and apply the patches** as soon as possible. These aren't optional updates—they're critical fixes for actively dangerous flaws. 3. **Monitor your network logs** for any unusual activity, especially if you haven't patched yet. Remember, the window between a patch release and active exploitation is shrinking every year. Attackers know that most organizations take weeks to apply updates, and they're counting on that delay. ### The Bigger Picture This isn't just another routine patch Tuesday. The fact that Cisco found these issues through an internal review is actually a good sign—it means they're actively hunting for vulnerabilities rather than waiting for someone else to stumble upon them. But it also raises a question: how many more are lurking? For network administrators, this is a reminder that your infrastructure is only as secure as your update process. If you've been putting off maintenance windows or deferring upgrades, now's the time to reconsider. The cost of downtime from a patch is almost always less than the cost of a full-blown security incident. Take a few minutes today to check your systems. If you're affected, prioritize those patches. Your future self—and your entire network—will thank you.