{"slug": "cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch", "title": "Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch", "summary": "Cisco released a set of seven patches for its IOS XR network operating system, including two critical vulnerabilities rated 9.8, that could allow remote code execution and root access on routers. All IOS XR releases, including IOS XR7, are affected, and Cisco has provided software maintenance upgrades starting with version 7.3. The flaws were internally discovered and are not yet known to be actively exploited, but experts urge immediate patching due to the critical nature of the equipment.", "body_md": "Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS).\n\nAs part of its regular testing, Cisco’s software engineering team flagged “multiple internally-discovered [vulnerabilities](https://www.csoonline.com/article/4218759/security-leaders-must-prepare-for-likely-threats-not-sensationalized-agentic-attacks.html),” the company said. These flaws could allow attackers to perform remote code execution (RCE) and gain root access on a router, thereby allowing them to intercept traffic. Other potential risks could include access control failures, buffer overflows, and out-of-bounds access.\n\nCisco said all IOS XR releases, including IOS XR7, are impacted, regardless of configuration. There are no known workarounds, but the company has released software updates.\n\nCisco emphasizes that, as of yet, the vulnerabilities are not known to be actively exploited.\n\nIOS XR runs on some of the most critical routing infrastructure in a network, explained [Erik Avakian](https://www.infotech.com/profiles/erik-avakian), a technical counselor at Info-Tech Research Group. “The most serious vulnerabilities can potentially be exploited remotely with low attack complexity, without privileges or any user interaction,” he said. “That’s enough to warrant immediate attention and timely patching.”\n\nTwo of the seven vulnerabilities identified by Cisco are rated 9.8 in severity (critical) based on the Common Vulnerability Scoring System (CVSS).\n\n[CVE-2026-20274](https://www.cve.org/CVERecord?id=CVE-2026-20274) and [CVE-2026-20279](https://www.cve.org/CVERecord?id=CVE-2026-20274) both address lifetime resource control issues, such as inappropriate certificate validation, incorrect or missing authorization for critical functions, resource operation after release or expiration, out-of-bounds read or write, initialization of resources with insecure details, and resource allocation without throttling limits.\n\nThe five other vulnerabilities are rated between 8.8 and 8.2 (high severity). Those patches address incorrect network usage calculations (buffer size, overflow, underflow), improper checks or handling of exceptional conditions or inconsistencies, insufficient control flow management, and protection mechanism failures.\n\nHowever, Cisco hasn’t explicitly said that every one of these issues can lead to RCE, Info-Tech’s Avakian noted. But access control issues could allow an attacker to reach resources they shouldn’t be able to, while memory-related flaws could cause system crashes, denial of service, or create a path toward code execution. If an attacker gained “meaningful control” of a device, that could result in network and business disruption, unapproved configuration changes, routing manipulation, or could pave the way for a broader attack, he said.\n\nThe two 9.8s are all about “getting access and persistence,” said [David Shipley](https://www.linkedin.com/in/dbshipley/) of Beauceron Security. Both RCE and root router access are in the Salt Typhoon playbook, he pointed out, adding, “worst case scenarios with some of these lower CVSS bugs is widespread network disruption and outages.”\n\nThese are critical flaws in carrier-grade equipment, and telecom companies worldwide should be paying attention, “because you can bet there is a bunch of nation-state hacking teams who are,” he noted.\n\nCustomers can identify whether a device is running Cisco IOS XR by using the “show version” command, the company said. They should upgrade to a release with available software maintenance upgrades (SMUs), or targeted software patches that don’t require a full system upgrade, then apply appropriate SMUs.\n\nAvailable SMUs cover software trains from various versions, starting with version 7.3. There may be up to 16 SMUs for each release, and customers requiring patches for other releases not identified by Cisco should contact their security support organization or open a Cisco service request, the company said. Future Cisco IOS XR Software releases (26.2.2 and 26.3.1) will be the first fixed releases not requiring SMUs.\n\nAvakian advised prioritizing patching based on exposure and criticality. “Internet-facing and core routing systems keeping the network running should move to the front of the line,” he said. Another important step is to look closely at how these devices are being managed, and what’s actually exposed.\n\nThis makes the case for [zero-trust principles](https://www.csoonline.com/article/4048002/88-of-cisos-struggle-to-implement-zero-trust.html): Restricting administrative access, applying and validating segmentation and access control lists (ACLs), and using out-of-band management “where practical,” Avakian said. Meanwhile, response teams should look for unexpected process crashes, configuration changes, unusual authentication activity, or unexplained routing changes.\n\nThere’s one additional consideration: It’s quite possible that even though an organization might not be running IOS XR directly, their telecom provider, MSP, or another critical partner might be, he noted.\n\n“So, I’d be asking your various suppliers how they’re addressing it on their end: Whether they’re affected, if they’ve patched, and when remediation will be completed,” Avakian said. While the good news is that Cisco isn’t currently aware of public exploitation, the vulnerabilities are still public, there are no workarounds, and the highest-severity issues have characteristics attackers may try to exploit, he pointed out, “so timely patching is critical.”\n\nInterestingly, the total number of bugs addressed in the advisory is grouped around common weaknesses and use a CVE per weakness, instead of per bug, Shipley noted. Its bug count is quite the contrast with Microsoft’s, which has doubled the size of its Patch Tuesday update with all the bugs it’s fixing.\n\n“Two global firms, both using AI, two different takes on communicating how many bugs were found that need to be fixed,” Shipley said.\n\n“That doesn’t help transparency, “ he said. “But it does make [Cisco’s] products look like they have less bugs, which is more a marketing move than a security move.”\n\nAlso worth noting is that Cisco said the bugs were found during internal tests, using frontier AI, he added.\n\nAvakian also noted the “new normal,” where AI is already beginning to find vulnerabilities much faster than humans can. That means that, while suppliers may find vulnerabilities faster, adversaries will also increasingly have access to the same types of capabilities and speed. “In many ways, it becomes an AI-against-AI race,” he said.\n\nThe challenge for CIOs and security leaders will now be how quickly they can understand their exposure, appropriately test the patches, and safely get fixes into production, Avakian said. “As AI accelerates exploit development while enterprise patching still takes weeks or months, the gap becomes increasingly unsustainable,” he pointed out.", "url": "https://wpnews.pro/news/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch", "canonical_source": "https://www.networkworld.com/article/4219946/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch.html", "published_at": "2026-09-09 02:18:52+00:00", "updated_at": "2026-09-09 02:49:45.661509+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Cisco", "IOS XR", "CVE-2026-20274", "CVE-2026-20279", "Info-Tech Research Group", "Erik Avakian", "Beauceron Security", "David Shipley"], "alternates": {"html": "https://wpnews.pro/news/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch", "markdown": "https://wpnews.pro/news/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch.md", "text": "https://wpnews.pro/news/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch.txt", "jsonld": "https://wpnews.pro/news/cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch.jsonld"}}