VulnSocial

CVE-2026-20267Disclosure(cisco / ios_xe)

LOWCVSS 9.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch cisco ios_xe systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. 

cisco CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-284

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ios_xe

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 7 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 4d ago at 3 mentions (2026-08-05); latest day: 1
  • 7 total mentions across 5 days

Affected systems

Vendors
cisco
Products
ios_xe

267 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 5d
01223Mentions · 2026-08-05: 3Mentions · 2026-08-06: 1Mentions · 2026-08-11: 1Mentions · 2026-08-18: 1Mentions · 2026-09-24: 1PoC Mentioned / Linked · 2026-08-11: 1Patch / Workaround · 2026-08-05: 3Patch / Workaround · 2026-08-11: 1Technical Details · 2026-08-05: 3Technical Details · 2026-08-11: 1Technical Details · 2026-09-24: 108-0508-0608-1108-1809-24
Signal classification3 categories
Disclosure
342.9%
Patch
342.9%
General
114.3%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-08-053
Disclosure1Patch2
2026-08-061
General1
2026-08-111
Patch1
2026-08-181
Disclosure1
2026-09-241
Disclosure1
Full discourse7 posts
  • ThreatWire@ThreatWire_
    Patch

    🚨 Cisco has patched two critical IOS XE vulnerabilities. CVE-2026-20272 is rated CVSS 9.8, while CVE-2026-20267 scores 9.0. Cisco is urging customers to patch immediately to reduce the risk of exploitation. #Cisco #IOSXE #CVE #CyberSecurity #NetworkSecurity #Infosec

    Post summary

    Cisco announced patches for two high‑severity IOS XE CVEs, urging customers to apply them immediately to mitigate exploitation risks.

    0311121.3K
    1.7K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Cisco IOS XE vulnerability CVE-2026-20272 hits CVSS 9.8 and CVE-2026-20267 scores 9.0. Cisco urges customers to patch now. #Cisco #IOSXE #CVE202620272 #CVE202620267 #CyberSecurity #NetworkSecurity http://securityonline.info/cisco-ios-xe-cve-2026-20272/

    Post summary

    Cisco highlights new high‑severity CVEs in IOS XE and urges users to apply patches immediately.

    00021477
    13.0K followersView on X
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-20267: Cisco IOS XE Improper Access Control - What It Means for Your Business and How to Respond https://hubs.li/Q04ycRcs0

    Post summary

    The text announces CVE-2026-20267 in Cisco IOS XE related to improper access control and provides technical details, but lacks explicit information about PoCs, exploits, active exploitation, or specific patches. The primary focus is disclosure of the vulnerability and business implications.

    10010113
    35 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Disclosure

    【緊急】CVE-2026-20267 シスコシステムズのCisco IOS XEに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/08/15/cve-2026-20267-cisco-ios-xe/ #IT #Security #cybersecurity

    Post summary

    The post announces a serious vulnerability (CVE‑2026‑20267) affecting Cisco IOS XE and urges immediate action; it provides no proof‑of‑concept, exploit, or mitigation details.

    00000103
    210 followersView on X
  • BT Haberler@BTHaberler
    Patch

    Cisco, SD-WAN ve IOS XE'de Üçü CVSS 9.9 Olan 12 Kritik Açığı Kapattı Cisco, iç güvenlik incelemesi kapsamında Catalyst SD-WAN ve IOS XE yazılımlarını etkileyen 12 açığı kapatan güncellemeler yayınladı; SD-WAN tarafındaki üç açık maksimuma yakın CVSS 9.9 aldı! • CVE-2026-20303, CVE-2026-20304 ve CVE-2026-20310 (üçü de CVSS 9.9), sırasıyla giriş doğrulaması ve yol geçişi eksikliği, yetersiz erişim kontrolü ve bağlantı çözümleme sırası hatasından kaynaklanıyor; ayrıca CVSS 8.8'lik açık metin hassas veri depolama sorunu da bulunuyor. • IOS XE tarafında CVE-2026-20267 ile CVE-2026-20273 arasındaki yedi açık, arabellek taşması, komut enjeksiyonu ve giriş doğrulaması eksikliklerini kapsıyor; en yüksek CVSS puanı 9.8. • Cisco, bu açıkların şu ana kadar aktif olarak istismar edildiğine dair bir bilgi bulunmadığını açıkladı; ancak sistem yönetim arabirimini etkileyen ayrı bir açık olan CIMCown (CVE-2026-20200) için halka açık kanıt kodu zaten mevcut. Kurumsal ağların omurgasını oluşturan SD-WAN ve yönlendirici yazılımlarında aynı anda bu kadar çok maksimum puanlı açığın ortaya çıkması, ağ ekiplerinin güncelleme önceliklerini yeniden gözden geçirmesini gerektiriyor. #SiberGüvenlik #Cisco #SDWAN

    Post summary

    Cisco disclosed the release of patches for 12 critical SD‑WAN and IOS XE vulnerabilities, providing technical details and confirming no active exploitation yet.

    00000128
    38 followersView on X
  • SecureShield@SecureShield_
    General

    一次情報(NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-20267 参照元(ベンダー等): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ

    Post summary

    The post shares links to the NVD entry for CVE-2026-20267 and a Cisco security advisory, but contains no explicit technical details or evidence of active exploitation.

    00000102
    25 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-20267 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering … CVSS 9.0 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-20267 #Cisco #CyberSecurity #InfoSec

    Post summary

    A critical Cisco IOS XE vulnerability (CVE‑2026‑20267) has been disclosed with a CVSS score of 9.0 and no patch yet, accompanied by a link to a full analysis.

    0000072
    88 followersView on X
CPE platform detail267 entries

267 of 267 entries

PartVendorProductVersionTarget SWTarget HW
OSciscoios_xe16.10.1--
OSciscoios_xe16.10.1a--
OSciscoios_xe16.10.1b--
OSciscoios_xe16.10.1c--
OSciscoios_xe16.10.1d--
OSciscoios_xe16.10.1e--
OSciscoios_xe16.10.1f--
OSciscoios_xe16.10.1g--
OSciscoios_xe16.10.1s--
OSciscoios_xe16.10.2--
OSciscoios_xe16.10.3--
OSciscoios_xe16.11.1--
OSciscoios_xe16.11.1a--
OSciscoios_xe16.11.1b--
OSciscoios_xe16.11.1c--
OSciscoios_xe16.11.1s--
OSciscoios_xe16.11.2--
OSciscoios_xe16.12.1--
OSciscoios_xe16.12.10--
OSciscoios_xe16.12.10a--
OSciscoios_xe16.12.11--
OSciscoios_xe16.12.12--
OSciscoios_xe16.12.13--
OSciscoios_xe16.12.14--
OSciscoios_xe16.12.15--
OSciscoios_xe16.12.16--
OSciscoios_xe16.12.1a--
OSciscoios_xe16.12.1c--
OSciscoios_xe16.12.1s--
OSciscoios_xe16.12.1t--
OSciscoios_xe16.12.1w--
OSciscoios_xe16.12.1x--
OSciscoios_xe16.12.1y--
OSciscoios_xe16.12.1z--
OSciscoios_xe16.12.1z1--
OSciscoios_xe16.12.1z2--
OSciscoios_xe16.12.2--
OSciscoios_xe16.12.2a--
OSciscoios_xe16.12.2s--
OSciscoios_xe16.12.2t--
OSciscoios_xe16.12.3--
OSciscoios_xe16.12.3a--
OSciscoios_xe16.12.3s--
OSciscoios_xe16.12.4--
OSciscoios_xe16.12.4a--
OSciscoios_xe16.12.5--
OSciscoios_xe16.12.5a--
OSciscoios_xe16.12.5b--
OSciscoios_xe16.12.6--
OSciscoios_xe16.12.6a--
OSciscoios_xe16.12.7--
OSciscoios_xe16.12.8--
OSciscoios_xe16.12.9--
OSciscoios_xe16.6.10--
OSciscoios_xe16.6.2--
OSciscoios_xe16.6.3--
OSciscoios_xe16.6.4--
OSciscoios_xe16.6.4a--
OSciscoios_xe16.6.4s--
OSciscoios_xe16.6.5--
OSciscoios_xe16.6.5a--
OSciscoios_xe16.6.5b--
OSciscoios_xe16.6.6--
OSciscoios_xe16.6.7--
OSciscoios_xe16.6.7a--
OSciscoios_xe16.6.8--
OSciscoios_xe16.6.9--
OSciscoios_xe16.7.1--
OSciscoios_xe16.7.1a--
OSciscoios_xe16.7.1b--
OSciscoios_xe16.7.2--
OSciscoios_xe16.7.3--
OSciscoios_xe16.7.4--
OSciscoios_xe16.8.1--
OSciscoios_xe16.8.1a--
OSciscoios_xe16.8.1b--
OSciscoios_xe16.8.1c--
OSciscoios_xe16.8.1d--
OSciscoios_xe16.8.1e--
OSciscoios_xe16.8.1s--
OSciscoios_xe16.8.2--
OSciscoios_xe16.8.3--
OSciscoios_xe16.9.1--
OSciscoios_xe16.9.1a--
OSciscoios_xe16.9.1b--
OSciscoios_xe16.9.1c--
OSciscoios_xe16.9.1d--
OSciscoios_xe16.9.1s--
OSciscoios_xe16.9.2--
OSciscoios_xe16.9.2a--
OSciscoios_xe16.9.2s--
OSciscoios_xe16.9.3--
OSciscoios_xe16.9.3a--
OSciscoios_xe16.9.3h--
OSciscoios_xe16.9.3s--
OSciscoios_xe16.9.4--
OSciscoios_xe16.9.4c--
OSciscoios_xe16.9.5--
OSciscoios_xe16.9.5f--
OSciscoios_xe16.9.6--
OSciscoios_xe16.9.7--
OSciscoios_xe16.9.8--
OSciscoios_xe16.9.8a--
OSciscoios_xe16.9.8b--
OSciscoios_xe17.1.1--
OSciscoios_xe17.1.1a--
OSciscoios_xe17.1.1s--
OSciscoios_xe17.1.1t--
OSciscoios_xe17.1.2--
OSciscoios_xe17.1.3--
OSciscoios_xe17.10.1--
OSciscoios_xe17.10.1a--
OSciscoios_xe17.10.1b--
OSciscoios_xe17.11.1--
OSciscoios_xe17.11.1a--
OSciscoios_xe17.12.1--
OSciscoios_xe17.12.1a--
OSciscoios_xe17.12.1w--
OSciscoios_xe17.12.1x--
OSciscoios_xe17.12.1y--
OSciscoios_xe17.12.1z--
OSciscoios_xe17.12.1z1--
OSciscoios_xe17.12.1z2--
OSciscoios_xe17.12.1z3--
OSciscoios_xe17.12.1z4--
OSciscoios_xe17.12.1z5--
OSciscoios_xe17.12.1z6--
OSciscoios_xe17.12.2--
OSciscoios_xe17.12.2a--
OSciscoios_xe17.12.3--
OSciscoios_xe17.12.3a--
OSciscoios_xe17.12.4--
OSciscoios_xe17.12.4a--
OSciscoios_xe17.12.4b--
OSciscoios_xe17.12.5--
OSciscoios_xe17.12.5a--
OSciscoios_xe17.12.5b--
OSciscoios_xe17.12.5c--
OSciscoios_xe17.12.5d--
OSciscoios_xe17.12.6--
OSciscoios_xe17.12.6a--
OSciscoios_xe17.12.6b--
OSciscoios_xe17.12.7--
OSciscoios_xe17.12.7a--
OSciscoios_xe17.12.7b--
OSciscoios_xe17.13.1--
OSciscoios_xe17.13.1a--
OSciscoios_xe17.14.1--
OSciscoios_xe17.14.1a--
OSciscoios_xe17.15.1--
OSciscoios_xe17.15.1a--
OSciscoios_xe17.15.1b--
OSciscoios_xe17.15.1w--
OSciscoios_xe17.15.1x--
OSciscoios_xe17.15.1y--
OSciscoios_xe17.15.2--
OSciscoios_xe17.15.2a--
OSciscoios_xe17.15.2b--
OSciscoios_xe17.15.2c--
OSciscoios_xe17.15.3--
OSciscoios_xe17.15.3a--
OSciscoios_xe17.15.3b--
OSciscoios_xe17.15.4--
OSciscoios_xe17.15.4a--
OSciscoios_xe17.15.4b--
OSciscoios_xe17.15.4c--
OSciscoios_xe17.15.4d--
OSciscoios_xe17.15.4s1--
OSciscoios_xe17.15.5--
OSciscoios_xe17.15.5a--
OSciscoios_xe17.15.7--
OSciscoios_xe17.16.1--
OSciscoios_xe17.16.1a--
OSciscoios_xe17.17.1--
OSciscoios_xe17.18.1a--
OSciscoios_xe17.18.1w--
OSciscoios_xe17.18.1x--
OSciscoios_xe17.18.1y--
OSciscoios_xe17.18.1z--
OSciscoios_xe17.18.2--
OSciscoios_xe17.18.3--
OSciscoios_xe17.18.3a--
OSciscoios_xe17.2.1--
OSciscoios_xe17.2.1a--
OSciscoios_xe17.2.1r--
OSciscoios_xe17.2.1v--
OSciscoios_xe17.2.2--
OSciscoios_xe17.2.3--
OSciscoios_xe17.3.1--
OSciscoios_xe17.3.1a--
OSciscoios_xe17.3.1w--
OSciscoios_xe17.3.1x--
OSciscoios_xe17.3.1z--
OSciscoios_xe17.3.2--
OSciscoios_xe17.3.2a--
OSciscoios_xe17.3.3--
OSciscoios_xe17.3.3a--
OSciscoios_xe17.3.4--
OSciscoios_xe17.3.4a--
OSciscoios_xe17.3.4b--
OSciscoios_xe17.3.4c--
OSciscoios_xe17.3.5--
OSciscoios_xe17.3.5a--
OSciscoios_xe17.3.5b--
OSciscoios_xe17.3.6--
OSciscoios_xe17.3.7--
OSciscoios_xe17.3.8--
OSciscoios_xe17.3.8a--
OSciscoios_xe17.4.1--
OSciscoios_xe17.4.1a--
OSciscoios_xe17.4.1b--
OSciscoios_xe17.4.1c--
OSciscoios_xe17.4.2--
OSciscoios_xe17.4.2a--
OSciscoios_xe17.5.1--
OSciscoios_xe17.5.1a--
OSciscoios_xe17.6.1--
OSciscoios_xe17.6.1a--
OSciscoios_xe17.6.1x--
OSciscoios_xe17.6.1z--
OSciscoios_xe17.6.1z1--
OSciscoios_xe17.6.2--
OSciscoios_xe17.6.3--
OSciscoios_xe17.6.3a--
OSciscoios_xe17.6.4--
OSciscoios_xe17.6.5--
OSciscoios_xe17.6.5a--
OSciscoios_xe17.6.6--
OSciscoios_xe17.6.6a--
OSciscoios_xe17.6.7--
OSciscoios_xe17.6.8--
OSciscoios_xe17.6.8a--
OSciscoios_xe17.7.1--
OSciscoios_xe17.7.1a--
OSciscoios_xe17.7.1b--
OSciscoios_xe17.7.2--
OSciscoios_xe17.8.1--
OSciscoios_xe17.8.1a--
OSciscoios_xe17.9.1--
OSciscoios_xe17.9.1a--
OSciscoios_xe17.9.1w--
OSciscoios_xe17.9.1x--
OSciscoios_xe17.9.1x1--
OSciscoios_xe17.9.1y--
OSciscoios_xe17.9.1y1--
OSciscoios_xe17.9.2--
OSciscoios_xe17.9.2a--
OSciscoios_xe17.9.3--
OSciscoios_xe17.9.3a--
OSciscoios_xe17.9.4--
OSciscoios_xe17.9.4a--
OSciscoios_xe17.9.5--
OSciscoios_xe17.9.5a--
OSciscoios_xe17.9.5b--
OSciscoios_xe17.9.5c--
OSciscoios_xe17.9.5d--
OSciscoios_xe17.9.5e--
OSciscoios_xe17.9.5f--
OSciscoios_xe17.9.6--
OSciscoios_xe17.9.6a--
OSciscoios_xe17.9.7--
OSciscoios_xe17.9.7a--
OSciscoios_xe17.9.7b--
OSciscoios_xe17.9.8--
OSciscoios_xe17.9.9--
OSciscoios_xe26.1.1--
OSciscoios_xe26.1.1a--

Explore more

Back to dashboardcisco CVEsios_xe vulnerabilities