InfoSecBulletin Cybersecurity for mankind
Cisco has put out an important update for Cisco IOS XE Software. This update fixes serious security holes that could let remote attacks target enterprise network devices.
The flaws can impact Cisco IOS XE Software in both autonomous mode and controller mode, no matter how the device is set up. Cisco looked at versions 17.9, 17.12, 17.15, 17.18, and 26.1 during the review.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The biggest flaw is CVE-2026-20272, which has a high CVSS score of 9.8 out of 10. This issue is related to CWE-74, or not properly handling special elements. This weakness can lead to risks like command injection, operating system injection, and argument injection.
Catalyst SD-WAN Software
Cisco has released updates to improve security for its Catalyst SD-WAN Software. This follows an internal check that found several serious weaknesses in the system. Cisco’s engineering team found the problems themselves, not from outside reports. The company said there is no proof that anyone is actively using these flaws.
CVE-2026-20303 stems from improper input validation and encompasses related weaknesses such as path traversal and external control of file paths.
CVE-2026-20304 covers improper access control, bundling authorization, authentication, and privilege-related bypass issues into a single entry. CVE-2026-20310 involves improper link resolution before file access, a class of bug that can let attackers manipulate symbolic links to reach unintended files.
These flaws are the biggest risks in this advisory. Next, CVE-2026-20312 has a score of 8.8. It deals with storing sensitive information in plain text. This means that if the system is hacked, passwords or other secrets could be at risk. CVE-2026-20313 has a score of 7.7 and is about not checking a specific number in input properly. It’s less serious but still an important issue.
Cisco has made it clear that there are no fixes for these problems, so the only way to deal with them is to upgrade the software. Organizations using Catalyst SD-WAN versions before 20.9 need to switch to a supported version completely, as the old versions won’t get a patch.
IBM
IBM has shared update about three serious weaknesses in three products, all rated CVSS 9.8. The issues impact App Connect Enterprise, Power HMC, and webMethods Integration. Two of these allow attackers to run any command or code without logging in. IBM states there have been no attacks using these flaws in real life.
| CVE | CVSSÂ (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-12943 | 9.8 | CWE-78 | — | Not exploited |
| CVE-2026-12118 | 9.8 | CWE-502 | — | Not exploited |
| CVE-2026-15435 | 9.8 | CWE-22 | — | Not exploited |
Affected versions
App Connect Enterprise versions 12.0.1.0 to 12.0.12.27 and 13.0.1.0 to 13.0.7.2 have issues. Power HMC versions V10.3.1050.0 to V10.3.1064.0 and V11.1.1110.0 to V11.1.1112.0 are weak. webMethods Integration Server versions 10.11 and 10.15 include the dangerous package.
Patch and mitigation
For App Connect Enterprise, use fix pack 12.0.12.28 or 13.0.8.0. For Power HMC, get the updates from IBM Fix Central. For webMethods, there is no code patch from IBM. Instead, delete the WmServiceMock package from all production and internet-facing nodes. Doing these steps fixes all three critical issues from IBM.
