AMA - 2026 IOS XE Software Security Hardening update

Cisco has released the August 2026 IOS XE Software Security Hardening update, which includes important security fixes for vulnerabilities impacting Cisco IOS XE-based platforms.

This release is particularly important as the Wireless PSIRTS security release has been impacted by two high-severity defects:

• CSCwv93265 - Downstream 802.11 action frames are not seen over the air

• CSCwv98483 - 9800 Foreign dropping client traffic from Anchor

We understand that you might be having questions about these defects, the latest PSIRTS release, recommended software versions, and most importantly, how to plan an upgrade leveraging tools like WLAN Poller, RADKit that addresses the security vulnerabilities safely while also taking the associated defects/FN CNSS bug id into consideration. We are happy to address any queries you might be having related PSIRT, FN, CNSS, Upgrade steps so you can effectively plan your upgrades to make sure your APs are safe.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

Summary:

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Exploitation and Public Announcements

In August 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

Synopsis of CSCwv93265

Summary:

The following action frames get dropped by Catalyst 9k APs:

• OpenRoaming
• 802.11k
• 802.11v
• 802.11r FT Over the DS
• TSPEC

Known Affected Versions:

Known Affected Versions are the same ones recommended in the Cisco IOS XE Software Security Hardening Release: August 2026. They are:

• 17.09.10
• 17.12.08
• 17.15.06
• 17.18.04a
• 26.01.02

Severity:

Severe (2)

Additional Info:

1. APSP will be released soon for customer testing deployment.
2. Above-mentioned software will not be removed from the download sections (do not ask why). Instead, Cisco has put a yellow warning for everyone to see.
3. Release Notes of the versions mentioned above (Open Caveats &/or Behavior Change sections) have not been updated (as of 09 August 2026).
4. Warning from our accounts is to hold off until +10 days after the APSP has been released.

Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

>A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

>This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.

Exploitation and Public Announcements

• In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.