Cisco Ships Two Dozen Fixes — CVSS 10.0 FMC Auth Bypass, 9.9 SD-WAN Trio, IOS XE Command Injection

Cisco's August 6, 2026 advisory batch covers roughly two dozen vulnerabilities across firewall, routing, and server lines, and none shows confirmed in-the-wild exploitation yet. The top item is CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center that lets a remote unauthenticated attacker execute scripts and gain root through crafted HTTP requests. Three CVSS 9.9 flaws in Catalyst SD-WAN follow: CVE-2026-20303 (input validation), CVE-2026-20304 (access control), and CVE-2026-20310 (file access), alongside CVE-2026-20272, a CVSS 9.8 command injection in IOS XE. CVE-2026-20200, a CVSS 8.8 RCE in the Integrated Management Controller, affects UCS C-Series M7 and M8 servers in standalone mode and already has a public proof of concept.

The FMC bug matters because of what sits behind it, not because of the score. The Management Center is the single policy and configuration plane for an estate of firewalls, so root on it is control over segmentation itself: an attacker who holds it can read and rewrite the rules every managed device enforces, infer the topology those rules imply, and stage the next move from a console nobody expects to be hostile. That is a categorically worse position than one compromised edge box, and it is why an unauthenticated path to root on a security management product outranks three 9.9s on devices that at least force the attacker to reach a specific interface. The SD-WAN trio and the IOS XE injection belong in the same cycle anyway, because branch-edge managers are internet-facing by design and IOS XE runs nearly everywhere. What keeps this out of emergency territory is one sentence in the disclosure, no known exploitation, and the pickup tells the same story: a maximum-severity root bug on a firewall brain drew a single outlet's coverage. That quiet is the window defenders get to use cheaply.

Order of operations: patch FMC first, IMC second, since the IMC flaw is the one with working exploit code already published, then the SD-WAN managers and IOS XE. For each, ask one inventory question: can the management interface be reached from anything other than an admin network. An FMC or SD-WAN manager with a public address is the entire exposure case for those CVEs, and moving it behind VPN or bastion access is a same-day mitigation while the upgrade is scheduled. On servers, enumerate C-Series M7 and M8 hosts running in standalone mode, the stated condition for CVE-2026-20200, and restrict the management port the way you would any lights-out controller. Keep FMC HTTP access logs and admin audit trails from before the patch; if Cisco later confirms exploitation, those are the first records where a pre-auth root grab would surface. Pull exact fixed releases from Cisco's advisories rather than third-party summaries, because a batch this size usually lands staged across product trains.

Two developments would change the assessment. A KEV listing or a Cisco advisory update moving CVE-2026-20079 from no known exploitation to confirmed would convert patch-cycle work into incident response, and the pre-patch logs above would immediately become triage material. The second is weaponization of the SD-WAN trio: public code for any of the three 9.9s would put branch-edge managers on the same scanner lists the IMC proof of concept already invites.