InfoSecBulletin Cybersecurity for mankind
Cisco has put out an important update for Cisco IOS XE Software. This update fixes serious security holes that could let remote attacks target enterprise network devices.
The flaws can impact Cisco IOS XE Software in both autonomous mode and controller mode, no matter how the device is set up. Cisco looked at versions 17.9, 17.12, 17.15, 17.18, and 26.1 during the review.
Urgent patch! Cisco and IMB patch multiple flaws
OWASP Unveils GenAI LLM Top 10 2026 For Modern AI APPS
Greatness PhaaS Evades Email Security and MFA to Take Over Microsoft 365 Accounts
Pillar 4: Total 131 Indicators Set
How Bangladeshi’s Ogrs Be Evaluated By Newly Launched NRS & CIRS
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
The biggest flaw is CVE-2026-20272, which has a high CVSS score of 9.8 out of 10. This issue is related to CWE-74, or not properly handling special elements. This weakness can lead to risks like command injection, operating system injection, and argument injection.
Catalyst SD-WAN Software
Cisco has released updates to improve security for its Catalyst SD-WAN Software. This follows an internal check that found several serious weaknesses in the system. Cisco’s engineering team found the problems themselves, not from outside reports. The company said there is no proof that anyone is actively using these flaws.
CVE-2026-20303 stems from improper input validation and encompasses related weaknesses such as path traversal and external control of file paths.
CVE-2026-20304 covers improper access control, bundling authorization, authentication, and privilege-related bypass issues into a single entry. CVE-2026-20310 involves improper link resolution before file access, a class of bug that can let attackers manipulate symbolic links to reach unintended files.
These flaws are the biggest risks in this advisory. Next, CVE-2026-20312 has a score of 8.8. It deals with storing sensitive information in plain text. This means that if the system is hacked, passwords or other secrets could be at risk. CVE-2026-20313 has a score of 7.7 and is about not checking a specific number in input properly. It’s less serious but still an important issue.
Cisco has made it clear that there are no fixes for these problems, so the only way to deal with them is to upgrade the software. Organizations using Catalyst SD-WAN versions before 20.9 need to switch to a supported version completely, as the old versions won’t get a patch.
IBM
IBM has shared update about three serious weaknesses in three products, all rated CVSS 9.8. The issues impact App Connect Enterprise, Power HMC, and webMethods Integration. Two of these allow attackers to run any command or code without logging in. IBM states there have been no attacks using these flaws in real life.
| CVE | CVSSÂ (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-12943 | 9.8 | CWE-78 | — | Not exploited |
| CVE-2026-12118 | 9.8 | CWE-502 | — | Not exploited |
| CVE-2026-15435 | 9.8 | CWE-22 | — | Not exploited |
Affected versions
App Connect Enterprise versions 12.0.1.0 to 12.0.12.27 and 13.0.1.0 to 13.0.7.2 have issues. Power HMC versions V10.3.1050.0 to V10.3.1064.0 and V11.1.1110.0 to V11.1.1112.0 are weak. webMethods Integration Server versions 10.11 and 10.15 include the dangerous package.
Patch and mitigation
For App Connect Enterprise, use fix pack 12.0.12.28 or 13.0.8.0. For Power HMC, get the updates from IBM Fix Central. For webMethods, there is no code patch from IBM. Instead, delete the WmServiceMock package from all production and internet-facing nodes. Doing these steps fixes all three critical issues from IBM.
