Cisco patches critical vulnerabilities in SD-WAN and IOS XE software

Cisco has released security updates addressing 12 vulnerabilities in Catalyst SD-WAN and IOS XE software, including three critical flaws rated 9.8 on the CVSS scale. The Hacker News reports that the vulnerabilities affect Cisco Catalyst SD-WAN software regardless of device configuration, as well as IOS XE software running in autonomous or controller mode. The critical vulnerabilities could allow unauthenticated remote attackers to execute arbitrary code, cause denial of service or gain unauthorised access to affected devices. The patches were released as part of Cisco's routine internal security review and apply to widely deployed networking infrastructure used by enterprises, managed service providers and critical infrastructure organisations. The 9.8 CVSS rating indicates that exploitation does not require authentication or user interaction, meaning vulnerable devices could be compromised remotely by scanning and exploitation.

Why this matters for UK organisations

For UK organisations using Cisco networking equipment, particularly in SD-WAN deployments or branch office connectivity, this matters because these devices often sit at the edge of the network with direct internet exposure and privileged access to internal systems. SD-WAN platforms are increasingly targeted by threat actors because they provide a foothold into distributed networks, access to routing and traffic inspection capabilities, and potential visibility into encrypted traffic. The critical nature of these vulnerabilities means that exploitation could result in full device compromise, allowing attackers to intercept traffic, pivot into internal networks, or disrupt connectivity across multiple sites. For organisations with distributed networks, managed WAN services or hybrid cloud connectivity, ensuring that network infrastructure is patched promptly is a foundational security control that directly affects the integrity of the entire environment. The fact that these vulnerabilities were discovered during Cisco's internal security review rather than active exploitation is a reminder that proactive patching is essential, as attackers will likely develop exploits once the details are public.

What to review

For UK businesses using Cisco SD-WAN or IOS XE devices, this is a prompt to review whether these patches have been applied, whether you have an inventory of affected devices, and whether your patching process for network infrastructure is as disciplined as it is for servers and endpoints. Consider whether network devices are included in your vulnerability management programme, whether you have a process for emergency patching of critical network infrastructure, and whether you have monitoring in place to detect unusual activity on edge devices. Review whether your organisation has a clear process for testing and deploying network infrastructure patches, whether change control procedures allow for emergency patching when critical vulnerabilities are disclosed, and whether you have a rollback plan in case patches cause operational issues. This is also a prompt to consider whether your organisation has visibility into the firmware versions running on network devices, whether you have a process for tracking vendor security advisories, and whether network infrastructure patching is assigned to a specific team with clear accountability and timelines.

Source: The Hacker News