InfoSecBulletin Cybersecurity for mankind
Cisco has put out an important update for Cisco IOS XE Software. This update fixes serious security holes that could let remote attacks target enterprise network devices.
The flaws can impact Cisco IOS XE Software in both autonomous mode and controller mode, no matter how the device is set up. Cisco looked at versions 17.9, 17.12, 17.15, 17.18, and 26.1 during the review.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The biggest flaw is CVE-2026-20272, which has a high CVSS score of 9.8 out of 10. This issue is related to CWE-74, or not properly handling special elements. This weakness can lead to risks like command injection, operating system injection, and argument injection.
Catalyst SD-WAN Software
Cisco has released updates to improve security for its Catalyst SD-WAN Software. This follows an internal check that found several serious weaknesses in the system. Cisco’s engineering team found the problems themselves, not from outside reports. The company said there is no proof that anyone is actively using these flaws.
CVE-2026-20303 stems from improper input validation and encompasses related weaknesses such as path traversal and external control of file paths.
CVE-2026-20304 covers improper access control, bundling authorization, authentication, and privilege-related bypass issues into a single entry. CVE-2026-20310 involves improper link resolution before file access, a class of bug that can let attackers manipulate symbolic links to reach unintended files.
These flaws are the biggest risks in this advisory. Next, CVE-2026-20312 has a score of 8.8. It deals with storing sensitive information in plain text. This means that if the system is hacked, passwords or other secrets could be at risk. CVE-2026-20313 has a score of 7.7 and is about not checking a specific number in input properly. It’s less serious but still an important issue.
Cisco has made it clear that there are no fixes for these problems, so the only way to deal with them is to upgrade the software. Organizations using Catalyst SD-WAN versions before 20.9 need to switch to a supported version completely, as the old versions won’t get a patch.
IBM
IBM has shared update about three serious weaknesses in three products, all rated CVSS 9.8. The issues impact App Connect Enterprise, Power HMC, and webMethods Integration. Two of these allow attackers to run any command or code without logging in. IBM states there have been no attacks using these flaws in real life.
| CVE | CVSSÂ (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-12943 | 9.8 | CWE-78 | — | Not exploited |
| CVE-2026-12118 | 9.8 | CWE-502 | — | Not exploited |
| CVE-2026-15435 | 9.8 | CWE-22 | — | Not exploited |
Affected versions
App Connect Enterprise versions 12.0.1.0 to 12.0.12.27 and 13.0.1.0 to 13.0.7.2 have issues. Power HMC versions V10.3.1050.0 to V10.3.1064.0 and V11.1.1110.0 to V11.1.1112.0 are weak. webMethods Integration Server versions 10.11 and 10.15 include the dangerous package.
Patch and mitigation
For App Connect Enterprise, use fix pack 12.0.12.28 or 13.0.8.0. For Power HMC, get the updates from IBM Fix Central. For webMethods, there is no code patch from IBM. Instead, delete the WmServiceMock package from all production and internet-facing nodes. Doing these steps fixes all three critical issues from IBM.
