#ios-xe

Analysis · Jun 17, 2026 · Colten Anderson

The Cisco IOS XE reboot that wasn't remediation

Patching CVE-2023-20198 and rebooting the box clears the web shell but leaves the rogue admin account behind. If you ran one IOS XE web UI on the public internet in late 2023, you have an account audit to do before you close the ticket.