# CVE-2026-20267: Cisco IOS XE Software improper access control

Source: https://junglewise.ai/threats/cve-2026-20267-cisco-ios-xe-software-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20267 · Severity: critical · CVSS 9 · Published 2026-08-05

Cisco IOS XE is a network operating system used in Cisco switches and routers to manage data traffic and network security. A critical vulnerability in access control allows attackers to bypass authentication or authorization checks without requiring any credentials, potentially gaining full control over affected devices. This could lead to unauthorized access to sensitive network infrastructure, data theft, or service disruption.

Technologies: [Cisco IOS XE Software](https://junglewise.ai/threats/technologies/ios-xe-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20267 being exploited in the wild.

**How severe is CVE-2026-20267?** Critical severity, with a CVSS score of 9, published 5 August 2026.

**Which products and versions are affected?** Cisco IOS XE Software 17.9 (before 17.9.10), 17.12 (before 17.12.8), 17.15 (before 17.15.6), 17.18 (before 17.18.4), 26.1 (before 26.1.2).

**Is there a fix for CVE-2026-20267?** A patch was published on 2026-08-05: Patch released same day as disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20267 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20267?** Check whether you run Cisco IOS XE Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20267 is an improper access control vulnerability (CWE-284) discovered during Cisco's internal security review and grouped with related hardening issues under a single CVE identifier. The vulnerability affects Cisco IOS XE Software running in both autonomous and controller mode across multiple release families (17.9, 17.12, 17.15, 17.18, and 26.1), with the exception of Catalyst 3650 and 3850 Series Switches. The flaw allows network-accessible attackers to bypass access controls without authentication, achieving confidentiality, integrity, and availability impact (CVSS 9.0, vector AV:N/AC:L/PR:N/UI:N). Cisco has released patched versions: 17.9.10, 17.12.8, 17.15.6, 17.18.4/4a, and 26.1.2. No workarounds are available.

## Affected products

- Cisco IOS XE Software 17.9 (before 17.9.10), 17.12 (before 17.12.8), 17.15 (before 17.15.6), 17.18 (before 17.18.4), 26.1 (before 26.1.2)

## Timeline

- 2026-08-05: disclosed
- 2026-08-05: patched: Patch released same day as disclosure

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ)
- [https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification](https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification)

## Related threats

- [Cisco Snort 3 GRE detection engine denial of service](https://junglewise.ai/threats/cve-2026-20179-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco IOS and IOS XE denial of service in XMCP](https://junglewise.ai/threats/cve-2026-20301-cisco-ios-and-ios-xe-denial-of-service-in-xmcp)
- [Cisco IOS XE BEEP denial of service](https://junglewise.ai/threats/cve-2026-20263-cisco-ios-xe-beep-denial-of-service)
- [Cisco IOS XE SNMP denial of service in error handling](https://junglewise.ai/threats/cve-2026-20124-cisco-ios-xe-snmp-denial-of-service-in-error-handling)
- [Cisco Snort 3 detection engine denial of service](https://junglewise.ai/threats/cve-2026-20068-cisco-snort-3-detection-engine-denial-of-service)