Cisco has seen double the trouble with a domain name system (DNS) issue affecting some of its switches, alongside a new vulnerability exposed in its network access control kit.

According to The Cyber Express, multiple Cisco Small Business Switches rebooted repeatedly on Thursday due to a DNS glitch, affecting enterprises of all sizes around the world.

Network administrators reported that switches worldwide simultaneously began repeatedly rebooting every 10 to 30 minutes, causing significant network instability and outages until emergency fixes were applied.

The most commonly affected models were the CBS250, C1200, CBS350, SG350, and SG550X series, with Cisco SMB Firmware problems extending to versions 4.1.7.17, 4.1.3.36, and 4.1.7.24.

Errors were traced to the DNS client process, specifically the DNSC task that handles hostname-to-IP address lookups for the switch. On this occasion, it wasn’t able to translate examples such as the Cisco domain name into a numeric IP address.

Additional DNS resolution failures affected time synchronization domains, triggering the DNS client to treat the issue as unrecoverable, forcing Cisco switches to generate core dumps and automatically reboot.

With the issue affecting devices at the same time for multiple users, many of which had operated reliably for over a year, administrators speculated the issues stemmed from a behavior change in Cloudflare's 1.1.1.1 DNS service. This was as switches using different DNS services or that had DNS turned off completely were not affected. However, some devices with Cloudflare's 1.1.1.1 as a fallback option still crashed, showing the DNS client was susceptible to bad responses no matter its priority.

Cisco privately confirmed the problem to customers, verifying it impacted CBS, SG, and Catalyst 1200/1300 series switches, including CBS250 and C1200 models. No patch was available at time of writing.

Cisco ISE issues

The network giant did release updates this week to stem a problem in its Cisco Systems Identity Services Engine network access control (NAC) platform.

Released on Wednesday, the updates aim to resolve a flaw found on the same day that allowed authenticated remote attackers with administrative privileges to gain access to sensitive information using ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

That issue, designed as CVE-2026-20029, was put down to “improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application,” according to Cisco.

Users were advised to migrate to versions newer than release 3.2 if they hadn’t already, with individual patches made available for versions 3.2 to 3.4.

ISE and ISE-PIC release 3.5 is not affected by the flaw.

The exploit marks another major bug in Cisco’s NAC system, with a remote code execution (RCE) issue affecting ISE and ISE-PIC last summer.

Last year wasn’t the best year in general for Cisco. October for example saw a vulnerability hit its Simple Network Management Protocol (SNMP), which allowed malicious rootkits to be installed on network hardware.

This was followed by the networking giant facing heat from the U.S. government over a separate RCE-based exploit in its firewall offerings that may have allowed for a nation-state-backed breach.

The year ended with Cisco acknowledging such issues, unveiling in November its Resilient Infrastructure venture, which aimed to resolve users' problems with legacy ware.

Resilient Infrastructure promised problematic features to be disabled by default or requiring additional steps for configuration, before eventually being removed entirely. Cisco also said it would disable services, including web servers, SNMP, and guest shell by default, to reduce users’ attack surface.