CVE-2026-20281

High [CVE-2026-20281] Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

cisco-sa-phone-dos-txMYNRzvSource published Sep 2, 2026Source updated Sep 2, 2026

An unauthenticated remote attacker could exploit a flaw in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software to cause a denial of service (DoS) condition on an affected device. The flaw is caused by improper memory management when an affected device processes HTTP packets.

Affected products in this advisory

• Session Initiation Protocol (SIP) Software

Source-reported affected versions

• Scope: This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco SIP Software, are registered to Cisco Unified CM, and have Web Access enabled:
• 4.1(1)SR1 and earlier — Migrate to a fixed release
• Release 5 (first fixed: 5.0(1))
• Earlier than 14.4 — Migrate to a fixed release

4 more entries in the full advisory.

Source-reported fixed versions

• 5.0(1)
• 14.4(1)SR3
• 14.4(1)SR4
• 11.0(6)SR8

Mitigation guidance

• Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
• Release 4.1(1)SR1 and earlier: migrate to a fixed release.
• Release 5: upgrade to 5.0(1).
• Earlier than 14.4: migrate to a fixed release.

5 more entries in the full advisory.

Workarounds

• There are no workarounds that address this vulnerability. However, disabling Web Access mitigates this vulnerability.
• To disable Web Access on a specific device, follow these steps:
• Log in to the Unified CM to which the phone is registered using administrative privileges, which allow modification of devices.
• Choose Device > Phone.

6 more entries in the full advisory.

Advisory [CVE-2026-20212 +10] Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

cisco-sa-notice-f2SiMFxlSource published Aug 26, 2026Source updated Sep 2, 2026

This bulletin covers 11 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 Critical 9.8 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability High 7.5 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities Medium 5.9 To remediate the vulnerabilities that were disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more…

Affected products in this advisory

No product details extracted. Check the source bulletin.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Desk Phone 9800, 7800 and 8800, and 8875 Series Software IOS XR Software (security hardening release) Nexus 9000 Series Switches Silicon One Secure Email To fully remediate vulnerabilities to be disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.