{"id":9348,"date":"2026-09-09T02:22:40","date_gmt":"2026-09-09T02:22:40","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9348"},"modified":"2026-09-09T02:22:40","modified_gmt":"2026-09-09T02:22:40","slug":"cisco-bundles-fixes-for-multiple-vulnerabilities-some-critical-into-one-patch","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9348","title":{"rendered":"Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS).<\/p>\n

As part of its regular testing, Cisco\u2019s software engineering team flagged \u201cmultiple internally-discovered vulnerabilities<\/a>,\u201d the company said. These flaws could allow attackers to perform remote code execution (RCE) and gain root access on a router, thereby allowing them to intercept traffic. Other potential risks could include access control failures, buffer overflows, and out-of-bounds access.<\/p>\n

Cisco said all IOS XR releases, including IOS XR7, are impacted, regardless of configuration. There are no known workarounds, but the company has released software updates.<\/p>\n

Cisco emphasizes that, as of yet, the vulnerabilities are not known to be actively exploited.<\/p>\n

IOS XR runs on some of the most critical routing infrastructure in a network, explained Erik Avakian<\/a>, a technical counselor at Info-Tech Research Group. \u201cThe most serious vulnerabilities can potentially be exploited remotely with low attack complexity, without privileges or any user interaction,\u201d he said. \u201cThat\u2019s enough to warrant immediate attention and timely patching.\u201d<\/p>\n

Critical vulnerabilities allowing for \u2018improper\u2019 lifetime control issues<\/h2>\n

Two of the seven vulnerabilities identified by Cisco are rated 9.8 in severity (critical) based on the Common Vulnerability Scoring System (CVSS).<\/p>\n

CVE-2026-20274<\/a> and CVE-2026-20279<\/a> both address lifetime resource control issues, such as inappropriate certificate validation, incorrect or missing authorization for critical functions, resource operation after release or expiration, out-of-bounds read or write, initialization of resources with insecure details, and resource allocation without throttling limits.<\/p>\n

The five other vulnerabilities are rated between 8.8 and 8.2 (high severity). Those patches address incorrect network usage calculations (buffer size, overflow, underflow), improper checks or handling of exceptional conditions or inconsistencies, insufficient control flow management, and protection mechanism failures.<\/p>\n

However, Cisco hasn\u2019t explicitly said that every one of these issues can lead to RCE, Info-Tech\u2019s Avakian noted. But access control issues could allow an attacker to reach resources they shouldn\u2019t be able to, while memory-related flaws could cause system crashes, denial of service, or create a path toward code execution. If an attacker gained \u201cmeaningful control\u201d of a device, that could result in network and business disruption, unapproved configuration changes, routing manipulation, or could pave the way for a broader attack, he said.<\/p>\n

The two 9.8s are all about \u201cgetting access and persistence,\u201d said David Shipley<\/a> of Beauceron Security. Both RCE and root router access are in the Salt Typhoon playbook, he pointed out, adding, \u201cworst case scenarios with some of these lower CVSS bugs is widespread network disruption and outages.\u201d<\/p>\n

These are critical flaws in carrier-grade equipment, and telecom companies worldwide should be paying attention, \u201cbecause you can bet there is a bunch of nation-state hacking teams who are,\u201d he noted.<\/p>\n

What Cisco customers should do now<\/h2>\n

Customers can identify whether a device is running Cisco IOS XR by using the \u201cshow version\u201d command, the company said. They should upgrade to a release with available software maintenance upgrades (SMUs), or targeted software patches that don\u2019t require a full system upgrade, then apply appropriate SMUs.<\/p>\n

Available SMUs cover software trains from various versions, starting with version 7.3. There may be up to 16 SMUs for each release, and customers requiring patches for other releases not identified by Cisco should contact their security support organization or open a Cisco service request, the company said. Future Cisco IOS XR Software releases (26.2.2 and 26.3.1) will be the first fixed releases not requiring SMUs.<\/p>\n

Avakian advised prioritizing patching based on exposure and criticality. \u201cInternet-facing and core routing systems keeping the network running should move to the front of the line,\u201d he said. Another important step is to look closely at how these devices are being managed, and what\u2019s actually exposed.<\/p>\n

This makes the case for zero-trust principles<\/a>: Restricting administrative access, applying and validating segmentation and access control lists (ACLs), and using out-of-band management \u201cwhere practical,\u201d Avakian said. Meanwhile, response teams should look for unexpected process crashes, configuration changes, unusual authentication activity, or unexplained routing changes.<\/p>\n

There\u2019s one additional consideration: It\u2019s quite possible that even though an organization might not be running IOS XR directly, their telecom provider, MSP, or another critical partner might be, he noted.<\/p>\n

\u201cSo, I\u2019d be asking your various suppliers how they\u2019re addressing it on their end: Whether they\u2019re affected, if they\u2019ve patched, and when remediation will be completed,\u201d Avakian said. While the good news is that Cisco isn\u2019t currently aware of public exploitation, the vulnerabilities are still public, there are no workarounds, and the highest-severity issues have characteristics attackers may try to exploit, he pointed out, \u201cso timely patching is critical.\u201d<\/p>\n

AI heralding a whole new era of security<\/h2>\n

Interestingly, the total number of bugs addressed in the advisory is grouped around common weaknesses and use a CVE per weakness, instead of per bug, Shipley noted. Its bug count is quite the contrast with Microsoft\u2019s, which has doubled the size of its Patch Tuesday update with all the bugs it\u2019s fixing.<\/p>\n

\u201cTwo global firms, both using AI, two different takes on communicating how many bugs were found that need to be fixed,\u201d Shipley said.<\/p>\n

\u201cThat doesn\u2019t help transparency, \u201c he said. \u201cBut it does make [Cisco\u2019s] products look like they have less bugs, which is more a marketing move than a security move.\u201d <\/p>\n

Also worth noting is that Cisco said the bugs were found during internal tests, using frontier AI, he added. <\/p>\n

Avakian also noted the \u201cnew normal,\u201d where AI is already beginning to find vulnerabilities much faster than humans can. That means that, while suppliers may find vulnerabilities faster, adversaries will also increasingly have access to the same types of capabilities and speed. \u201cIn many ways, it becomes an AI-against-AI race,\u201d he said.<\/p>\n

The challenge for CIOs and security leaders will now be how quickly they can understand their exposure, appropriately test the patches, and safely get fixes into production, Avakian said. \u201cAs AI accelerates exploit development while enterprise patching still takes weeks or months, the gap becomes increasingly unsustainable,\u201d he pointed out.<\/p>\n

This article originally appeared on Network World<\/a>.<\/em><\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS). As part of its regular testing, Cisco\u2019s software engineering team flagged \u201cmultiple internally-discovered vulnerabilities,\u201d the company said. These flaws could allow attackers to perform […]<\/p>\n","protected":false},"author":0,"featured_media":9349,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9348"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9348"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9348\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9349"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}