Summary

• Cisco released its semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication on March 25, 2026. In direct response to customer feedback, Cisco releases bundles of Cisco IOS and IOS XE Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year.

  The March 25, 2026, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication includes 12 Cisco Security Advisories that describe 12 vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Cisco has released software updates that address these vulnerabilities. 

Details

• The following table identifies Cisco Security content that is associated with this bundled publication:

  Cisco Security Advisory	CVE ID	Security Impact Rating	CVSS Base Score
  Cisco IOS XE Software for Catalyst 9000 Series Switches DHCP Snooping Denial of Service Vulnerability	CVE-2026-20084	High	8.6
  Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family CAPWAP Denial of Service Vulnerability	CVE-2026-20086	High	8.6
  Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability	CVE-2026-20012	High	8.6
  Cisco IOS Software and IOS XE Software Release 3E HTTP Server Denial of Service Vulnerability	CVE-2026-20125	High	7.7
  Cisco IOS XE Software TLS Memory Exhaustion Denial of Service Vulnerability	CVE-2026-20004	High	7.4
  Cisco IOS XE Software for Cisco Catalyst and Rugged Series Switches Secure Boot Bypass Vulnerability	CVE-2026-20104	High	6.1
  Cisco IOS XE Software Denial of Service Vulnerability	CVE-2026-20110	Medium	6.5
  Cisco IOS XE Software Secure Copy Protocol Server Denial of Service Vulnerability	CVE-2026-20083	Medium	6.5
  Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability	CVE-2026-20115	Medium	6.1
  Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability	CVE-2026-20114	Medium	5.4
  Cisco IOx Application Hosting Environment Carriage Return Line Feed Injection Vulnerability	CVE-2026-20113	Medium	5.3
  Cisco IOx Application Hosting Environment Stored Cross-Site Scripting Vulnerability	CVE-2026-20112	Medium	4.8

   

  Related Resources

  Cisco Security Vulnerability Policy
  MITRE Common Vulnerabilities and Exposures
  Common Vulnerability Scoring System and the Security Impact Rating
  Common Vulnerability Scoring System Q & A