Two chained vulnerabilities. One command
And a Cisco Catalyst 9300 switch stops passing traffic entirely — no crash, no reboot, no alarm.
CVE-2026-20114 and CVE-2026-20110, uncovered by Opswat's Unit 515 Critical Infrastructure Protection Lab, let an attacker escalate privilege on Catalyst switch management and then force the device into "maintenance mode" — a state built for offline diagnostics, not for hardware carrying production traffic.
WHAT ACTUALLY HAPPENED
CVE-2026-20114 grants an attacker with limited access a path to escalate privilege on the switch's management plane. CVE-2026-20110 stems from insufficient input sanitization that lets that elevated access push a Catalyst 9300 into maintenance mode.
Chained together, the two flaws take an attacker from a foothold to a switch that silently stops forwarding traffic. No ransomware note, no exfiltration alert. Just a device that goes quiet while staying powered, reachable, and "healthy" on every dashboard that only checks uptime.
WHY LAYER 2 IS THE BLIND SPOT NOBODY WATCHES
Security budgets flow to endpoints, cloud posture, and identity. The switching fabric gets treated as plumbing — present, assumed reliable, rarely instrumented for state changes.
Maintenance mode isn't a crash. It's a valid operational state, which is exactly why nothing alerts on it. Monitoring tuned to catch reboots and link failures has no reason to flag a switch that is up, responsive, and simply not doing its job. An attacker who understands that gap gets an outage that reads as unplanned maintenance, timed against your incident response or your failover window.
WHAT TO DO NOW
PATCH CATALYST FIRMWARE IMMEDIATELY — Cisco has fixed releases for both CVEs; the chain needs both flaws unpatched, so closing either one breaks the attack path.
ALERT ON MAINTENANCE-MODE TRANSITIONS — flag any switch entering maintenance mode outside a scheduled window, not just reboots or link-down events.
AUDIT MANAGEMENT-PLANE ACCESS — privilege escalation still needs a starting foothold; review who can reach Catalyst management interfaces and why.
INSTRUMENT THE SWITCHING FABRIC LIKE ANY OTHER ASSET — extend the change-detection discipline you already apply to servers and endpoints down to the switches connecting them.
The most disruptive outage is the one that looks like scheduled maintenance.
Does your monitoring alert when a switch enters maintenance mode — or only when it goes dark?