Forwarded Taiwan Computer Network Emergency Response Team/Coordination Center Information Security Alert TWCERTCC-200-202608-00000004

[Content Description]
The Cisco IOS XE software development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, there is no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations. CVE-2026-20267(CVSS: 9.0) is an Improper Access Control vulnerability; CVE-2026-20272(CVSS: 9.8) is an Improper Handling of Special Elements vulnerability.

[Impacted Platform]
Cisco IOS XE version 17.9, Cisco IOS XE version 17.12, Cisco IOS XE version 17.15, Cisco IOS XE version 17.18, Cisco IOS XE version 26.1

[Recommended Actions]
Please update to the following versions: Cisco IOS XE 17.12.18(inclusive) or later versions, Cisco IOS XE 17.15.6(inclusive) or later versions, Cisco IOS XE 17.18.4(inclusive) or later versions, Cisco IOS XE 17.18.4a(inclusive) or later versions, Cisco IOS XE 26.1.2(inclusive) or later versions

[Reference]
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
2. https://nvd.nist.gov/vuln/detail/CVE-2026-20267
3. https://nvd.nist.gov/vuln/detail/CVE-2026-20272