轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202608-00000004

[內容說明]
Cisco IOS XE 軟體開發團隊於內部安全審查期間發現多項安全漏洞，並已完成修補。目前尚未發現有證據顯示這些漏洞遭到積極利用。為協助客戶及時部署安全更新並簡化漏洞揭露流程，Cisco 已公開相關漏洞資訊及修補建議。CVE-2026-20267(CVSS：9.0)為存取控制不當漏洞；CVE-2026-20272(CVSS：9.8)為特殊元素未適當處理漏洞。

[影響平台]
Cisco IOS XE 17.9版本、 Cisco IOS XE 17.12版本、 Cisco IOS XE 17.15版本、 Cisco IOS XE 17.18版本、 Cisco IOS XE 26.1版本

[建議措施]
請更新至以下版本： Cisco IOS XE 17.12.18(含)之後版本、 Cisco IOS XE 17.15.6(含)之後版本、 Cisco IOS XE 17.18.4(含)之後版本、 Cisco IOS XE 17.18.4a(含)之後版本、 Cisco IOS XE 26.1.2(含)之後版本

[參考資料]
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
2. https://nvd.nist.gov/vuln/detail/CVE-2026-20267
3. https://nvd.nist.gov/vuln/detail/CVE-2026-20272

Forwarded Taiwan Computer Network Emergency Response Team/Coordination Center Information Security Alert TWCERTCC-200-202608-00000004

[Content Description]
The Cisco IOS XE software development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, there is no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations. CVE-2026-20267(CVSS: 9.0) is an Improper Access Control vulnerability; CVE-2026-20272(CVSS: 9.8) is an Improper Handling of Special Elements vulnerability.

[Impacted Platform]
Cisco IOS XE version 17.9, Cisco IOS XE version 17.12, Cisco IOS XE version 17.15, Cisco IOS XE version 17.18, Cisco IOS XE version 26.1

[Recommended Actions]
Please update to the following versions: Cisco IOS XE 17.12.18(inclusive) or later versions, Cisco IOS XE 17.15.6(inclusive) or later versions, Cisco IOS XE 17.18.4(inclusive) or later versions, Cisco IOS XE 17.18.4a(inclusive) or later versions, Cisco IOS XE 26.1.2(inclusive) or later versions

[Reference]
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ
2. https://nvd.nist.gov/vuln/detail/CVE-2026-20267
3. https://nvd.nist.gov/vuln/detail/CVE-2026-20272