Recheck Your IOS XE Upgrade
Cisco revised its IOS XE fix matrix on 2 October. Recheck your destination; no workaround exists.
Choose the destination deliberately
Start with the device’s running train, not a saved assumption about what an earlier maintenance window installed. Match the intended destination to the current advisory and keep that decision with the change record. The next shift should be able to see why a particular image was selected without reconstructing the plan from an isolated conversation.
| Train | Destination |
|---|---|
| 17.8 and earlier | Migrate to a fixed release |
| 17.9 | 17.9.10 |
| 17.12 | 17.12.8 |
| 17.15 | 17.15.6 |
| 17.18 | 17.18.4 or 17.18.4a |
| 26.1 | 26.1.2 |
Seven class-level identifiers, CVE-2026-20267, CVE-2026-20268, CVE-2026-20269, CVE-2026-20270, CVE-2026-20271, CVE-2026-20272 (injection) and CVE-2026-20273, group multiple bugs. Scores are class maxima; injection reaches 9.8. Autonomous and controller deployments are affected regardless of configuration; Cisco reports no known malicious use.
Catalyst 3650/3850 switches on IOS XE 16.12 or earlier remain affected; no hardened 16.12 release is planned. Cisco’s future policy covers confirmed high-risk issues, not a full fix.
Test the path that people use
Choose a real traffic path that crosses the device and define its expected behaviour before the change. Test it again afterwards, alongside the management route that the team would need for recovery. A successful restart is useful evidence, but it cannot stand in for both a version check and a working service.
Where a device cannot move in the agreed window, keep it visibly separate from the completed set. Record the outstanding decision and who can authorise the next step. These are BlackTree’s operating checks, not a claim that a particular customer network has been tested.
Source: Cisco advisory, published 5 August; advisory version 1.1 revised 2 October.
Related: separate IOS XR advisory.
Updated on 15 October 2026 to expand the operating guidance and identify the injection class explicitly. The original 9 October publication date, URL and fixed-release matrix are unchanged.
