On September 9, 2026, Cisco confirmed that CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center, is being actively exploited, even though a patch has existed since March. Network teams must patch immediately, then hunt for indicators of compromise before declaring a device healthy.
On September 2, 2026, Cisco bundled seven internally discovered IOS XR vulnerabilities into seven CVEs grouped by CWE class, including two at CVSS 9.8 that affect every release of the core-router operating system. Apply the SMUs in your maintenance windows rather than waiting for releases 26.2.2 and 26.3.1.
On 2 September 2026 Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that leaves TCP ports 43210 and 43211 on ten Nexus 9000 switches reachable for unauthenticated remote code execution as root. Apply an iACL on both ports and the Live Protect lp00031 shield now, then check your release in the Software Checker.
On August 31, 2026, Sygnia documented how the Chinese espionage group Fire Ant, which heavily overlaps UNC3886, pivoted from VMware hypervisors to Cisco IOS XR routers to intercept the traffic passing through them. An active GRE tunnel missing from the running config is enough to turn a transit router into a collection platform — and it means defenders must audit routers as vantage points, not as mere hops.
On August 19, 2026, Cisco shipped a "hardening" release for Crosswork that neutralizes four vulnerabilities rated CVSS 10.0, without detailing a single one of them. Network operators must patch their management plane blind, on trust rather than on facts.
In August 2026 Cisco disclosed CVE-2026-20349, an 8.6 CVSS flaw in the SSL VPN of its ASA and FTD firewalls: one unauthenticated HTTP request forces the device to reload and drops VPN access for every remote worker. With no workaround available, patching is the only fix — and the flaw is already being exploited in the wild.
On August 5, 2026, Cisco shipped a massive hardening release for IOS XE and SD-WAN, bundling fixes for 12 vulnerabilities uncovered during an internal AI-assisted security review. Three reach CVSS 9.9. The era of AI-accelerated vulnerability discovery has hit the network hardware industry — and Cisco just showed what that looks like in production.
On July 29, 2026, Cisco disclosed two zero-day vulnerabilities in Secure Firewall Management Center: static hardcoded credentials (CVE-2026-20316) and a CVSS 10.0 authentication bypass (CVE-2026-20079). Check your logs immediately — both flaws share the same indicator of compromise.
The MEF published the MEF 70 standard in July 2019, Broadcom acquired VMware VeloCloud in November 2023, and FlexiWAN crossed 4,000 accounts in 2025 with open-source SD-WAN. The SD-WAN market hit $3.4 billion in 2024 and is projected to reach $13.7 billion by 2028 according to Gartner — here is why your MPLS contract is becoming a subscription to a horse-drawn carriage.
