Vulnerabilities & Exploits · DDoS
Cisco patches a dozen IOS and IOS XE flaws Cisco released patches for a dozen high- and medium-severity vulnerabilities in IOS and IOS XE. Four defects (CVE-2026-20110 , -20112, -20113, -20114) affecting Catalyst 9300 switches were publicly disclosed; two can be chained to escalate privileges and cause a persistent denial-of-service that required physical intervention in validated scenarios.
2 sources · Mar 26
CVE-2026-20113 NVD KEV
CVSS 5.3 MEDIUM: a vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE… EPSS 0.4% (30th percentile).
CVE-2026-20114 NVD KEV
CVSS 5.4 MEDIUM: a vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an… EPSS 0.4% (29th percentile).
CVE-2026-20112 NVD KEV
CVSS 4.8 MEDIUM: a vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE… EPSS 0.2% (16th percentile).
CVE-2026-20110 NVD KEV
CVSS 6.5 MEDIUM: a vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of… EPSS 0.1% (3rd percentile).
Timeline Sources Mar 26 SecurityWeek
Cisco Patches Multiple Vulnerabilities in IOS Software
The high- and medium-severity flaws could lead to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.
original Mar 25 Cisco PSIRT
Cisco Security Advisory: Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
original Mar 25 Cisco PSIRT
Cisco Security Advisory: Cisco IOx Application Hosting Environment Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
original Vendor digest: Cisco
Part of the PlainSec briefing for 2026-03-26
Every edition of this story: Cisco patches a dozen IOS and IOS XE flaws
More from today Vulnerabilities & Exploits · DDoS
Cisco patches a dozen IOS and IOS XE flaws Cisco released patches for a dozen high- and medium-severity vulnerabilities in IOS and IOS XE. Four defects (CVE-2026-20110 , -20112, -20113, -20114) affecting Catalyst 9300 switches were publicly disclosed; two can be chained to escalate privileges and cause a persistent denial-of-service that required physical intervention in validated scenarios.
2 sources · Mar 26
CVE-2026-20113 NVD KEV
CVSS 5.3 MEDIUM: a vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE… EPSS 0.4% (30th percentile).
CVE-2026-20114 NVD KEV
CVSS 5.4 MEDIUM: a vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an… EPSS 0.4% (29th percentile).
CVE-2026-20112 NVD KEV
CVSS 4.8 MEDIUM: a vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE… EPSS 0.2% (16th percentile).
CVE-2026-20110 NVD KEV
CVSS 6.5 MEDIUM: a vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of… EPSS 0.1% (3rd percentile).
Timeline Sources Mar 26 SecurityWeek
Cisco Patches Multiple Vulnerabilities in IOS Software
The high- and medium-severity flaws could lead to denial-of-service, secure boot bypass, information disclosure, and privilege escalation.
original Mar 25 Cisco PSIRT
Cisco Security Advisory: Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
original Mar 25 Cisco PSIRT
Cisco Security Advisory: Cisco IOx Application Hosting Environment Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
original Vendor digest: Cisco
Part of the PlainSec briefing for 2026-03-26
Every edition of this story: Cisco patches a dozen IOS and IOS XE flaws
More from today