Cisco Catalyst SD-WAN CVE-2026-20303 Leads Three 9.9 Bugs in a 12-Flaw Patch

Cisco has patched 12 vulnerabilities across Catalyst SD-WAN and IOS XE software, led by three critical bugs rated CVSS 9.9: Cisco Catalyst SD-WAN CVE-2026-20303 (improper input validation), CVE-2026-20304 (improper access control), and CVE-2026-20310 (improper link resolution). The SD-WAN flaws affect the software regardless of device configuration, and the IOS XE issues hit devices running in autonomous or controller mode. None are known to be exploited yet, and fixed releases are available now. Cisco says the bugs surfaced during internal security testing that combined its existing processes with frontier AI models.

That last detail is the story within the story. The three 9.9-rated SD-WAN bugs, plus a CVSS 9.8 IOS XE command-injection flaw (CVE-2026-20272), are exactly the vulnerability classes that legacy network code has hidden for years: path traversal, broken access control, unsafe link resolution, and argument injection. They were not found by a nation-state or a bug-bounty hunter. They were found by the vendor pointing modern tooling at its own stack. The practical takeaway for defenders is that the disclosure clock now runs both ways, because the same models can diff a patched binary.

The SD-WAN set is the priority. CVE-2026-20303 (NVD, CVSS 9.9, CWE-20) covers improper input validation including path traversal; CVE-2026-20304 is an improper access control flaw; and CVE-2026-20310 is an improper link resolution before file access. Two lower-severity SD-WAN issues round out that group: CVE-2026-20312 (CVSS 8.8, cleartext storage of sensitive information) and CVE-2026-20313 (CVSS 7.7). On the IOS XE side, CVE-2026-20272 (CVSS 9.8) is the standout, an improper-neutralization flaw that covers command, OS, and argument injection, alongside CVE-2026-20267 (CVSS 9.0, improper access control) and a cluster of 8.6-rated memory-safety and control-flow bugs.

How urgent is patching if nothing is exploited yet?

Treat "not known to be exploited" as a countdown, not an all-clear. Network engineers reacting to the advisory drew the obvious line: three authentication- and access-adjacent 9.9s on a widely deployed SD-WAN fabric are prime candidates for rapid weaponization once the fixed images are public and reversible. The pragmatic sequence is to patch internet-reachable management and control planes first, verify that the SD-WAN control plane is not exposed to untrusted interfaces, then stage edge rollouts while watching for regressions. Waiting for a public proof-of-concept means racing the same automation Cisco used to find the bugs.

Do AI-discovered vulnerabilities change the patch cadence?

They compress it. If a vendor can run frontier models across a legacy codebase and surface a dozen serious flaws in one pass, advisories stop being occasional and start being a stream. That is good for defenders who patch quickly and punishing for those who batch updates quarterly. The counter-pressure network teams raised is real too: bigger, more frequent releases risk breaking feature templates and API automation, which is why change validation has to keep pace with patch velocity rather than block it.

Fixed SD-WAN trains include 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, and 26.1.2; releases earlier than 20.9 should migrate to a fixed version. Apply the IOS XE updates for autonomous and controller-mode deployments per Cisco's advisory.

Our read

Continuous verification is the whole lesson. Cisco found these flaws by continuously testing its own code with the best tools available, which is precisely the posture we argue enterprises should adopt for the systems they run, rather than trusting an annual assessment. Our 2025 analysis of CISA's KEV data found that 67% of the year's actively exploited vulnerabilities would have been missed by a once-a-year pentest. A 12-CVE advisory that a vendor generated in a single internal review is what that gap looks like from the inside. Patch on the vendor's timeline, and assume attackers are diffing the fix on theirs.

Reporting by The Hacker News; CVE severities and fixed-release details per Cisco's security advisories and NVD. Sources linked above.

Related: Cisco Secure Firewall Management Center CVE-2026-20316 in CISA KEV · F5 NGINX CVE-2026-42533 heap overflow