Cisco patched five high-severity vulnerabilities across its enterprise product portfolio. Two SSRF vulnerabilities (CVE-2026-20034 and CVE-2026-20035) in Cisco Unity Connection stem from insufficient validation of user input and HTTP requests, potentially allowing remote authenticated attackers to execute arbitrary code as root or send network requests from the device. A high-severity DoS vulnerability (CVE-2026-20185) in the SNMP subsystem of SG350 and SG350X switches arises from improper error handling during SNMP response parsing, enabling attackers with valid SNMP credentials to reload the device. Another DoS vulnerability (CVE-2026-20188) in Crosswork Network Controller and Network Services Orchestrator results from missing rate-limiting on incoming connections, allowing resource exhaustion by unauthenticated attackers. The fifth high-severity bug (CVE-2026-20167) in the IoT Field Network Director web interface allows crafted input to cause router reloads and DoS. Cisco also fixed seven medium-severity vulnerabilities affecting other products. No known exploits in the wild have been reported. Cisco’s security advisories provide patch details.

Successful exploitation of these vulnerabilities could lead to remote code execution with root privileges, server-side request forgery attacks that may allow attackers to make network requests from the vulnerable device, and denial-of-service conditions causing device reloads or resource exhaustion. These impacts could disrupt enterprise network operations and potentially allow attackers to gain control over affected devices. However, Cisco reports no known exploitation in the wild at this time.

Cisco has released official patches addressing all identified high- and medium-severity vulnerabilities. Users of affected Cisco enterprise products should apply these patches promptly. Since this is not a cloud service, remediation depends on deploying the vendor-provided updates. Cisco’s security advisories contain detailed patch and update instructions. There are no indications that additional mitigation steps beyond patching are required.