Cisco Catalyst 9800 Security Upgrade Needs an Extra Wi-Fi Patch

Cisco's August security update for the Catalyst 9800 family includes the C9800-L, but Cisco later found that the first security-hardened releases can cause Wi-Fi connection and roaming problems. The fix is to plan the IOS XE upgrade and the matching Access Point Service Pack together.

Cisco released a major security update for IOS XE on 5 August 2026. IOS XE is the software that runs many Cisco network devices, including the Catalyst 9800 wireless controller used to manage a vessel's Wi-Fi access points.

The C9800-L is included in the affected product family. Cisco's advisory covers several vulnerabilities found during its own security testing, with the most severe carrying a CVSS score of 9.8. Cisco says it is not aware of these vulnerabilities being actively exploited, but there is no workaround; the recommended action is to install a fixed software release. 1

The important complication came after those fixed releases were published. Cisco documented serious Wi-Fi problems in the same security-hardened builds and now recommends installing an additional corrective patch for the access points. 2

For anyone maintaining a C9800-L, this means the job should be planned as a controller software upgrade plus the required access-point patching, rather than simply loading the IOS XE version shown as "fixed" in the original security advisory.

What can go wrong after the security upgrade?

Cisco bug CSCwv93265 can cause wireless devices to have difficulty connecting or moving between access points.

Cisco lists the problem against several common Wi-Fi features, including WPA3, OpenRoaming and the 802.11k, 802.11v and 802.11r roaming standards. 2

For readers who do not work with Wi-Fi standards every day, the important point is simple: these features help phones, tablets and laptops connect securely and move from one access point to another without losing service. On a large yacht with access points throughout the vessel, that handover between access points is a normal part of using the network.

A fault here could therefore show up as a device failing to join the Wi-Fi, dropping its connection, or struggling to stay connected as somebody moves through the yacht.

Cisco has issued an AP Service Pack, usually shortened to APSP, to correct this problem. This is an additional software patch that is distributed to the wireless access points through the controller.

Cisco recommends installing the APSP on all deployments running the affected security-hardened release. 2

Which IOS XE releases are involved?

Cisco lists the following as the first security-hardened releases for the relevant IOS XE software trains:

These are the releases that contain the August security fixes, but Cisco also lists them as affected by the roaming and connectivity bug described above. 1 2

Do not choose the target IOS XE release without also checking the matching APSP that Cisco requires for it.

Some guest Wi-Fi designs need another patch

Cisco has also documented a separate bug, CSCwv98483, affecting some C9800-L, CW9800-L and C9800-CL installations.

This second issue is more specific. It applies when the controller is being used in a guest-anchor design, where guest Wi-Fi traffic is passed between controllers rather than handled entirely by a single controller. In the affected condition, wireless clients can become stuck during the process of obtaining normal network connectivity. 2

Cisco has published a Software Maintenance Update (SMU) for affected releases. An SMU is a smaller targeted patch used to correct a specific problem without waiting for the next full IOS XE release.

A yacht using a straightforward standalone C9800-L without this guest-anchor arrangement would not normally fall into that particular case. It is still worth confirming the controller design before the update window rather than assuming the additional patch is unnecessary.

Allow enough time for the full upgrade

The upgrade method matters because both the controller and the access points are involved.

If a spare or secondary Catalyst 9800 controller is available, Cisco recommends an N+1 upgrade method that allows access points to be moved onto the already-updated controller.

Many yachts, however, operate a single C9800-L with no spare controller. For that situation, Cisco recommends a one-shot upgrade. 2

In simple terms, the main controller is upgraded and restarted, the access points reconnect and receive the new software, and the corrective APSP is then applied to the access points.

Cisco specifically warns that until the APSP has been applied, the access points can still experience the known connection and roaming problems.

That means the maintenance window has to cover more than the controller reboot. Time is also needed for the access points to download their software, restart or reconnect as required, and then receive the additional APSP. If the separate SMU is required for the installation, that can add another controller reload to the process.

What should be checked onboard?

Before starting the upgrade, the technical team should confirm the current controller version, the intended IOS XE release, and the correct APSP for that release. If the yacht uses a guest-anchor arrangement, check whether the additional SMU is required.

The controller configuration should be backed up before the work starts, and the required software packages should already be downloaded and available. On a standalone controller, the yacht should also expect a period where Wi-Fi is unavailable while the controller and access points are being updated.

Once the upgrade is complete, testing should go beyond confirming that the controller can see all of its access points.

A useful check is to connect normal crew or test devices to each important Wi-Fi network, verify authentication and internet access, and then physically move through several areas of the yacht to make sure the device can hand over between access points without repeatedly disconnecting. Guest Wi-Fi should also be tested separately if it uses different authentication or network routing.

On a vessel with dozens of access points, seeing every AP marked as "up" on the controller does not necessarily prove that the client experience is working correctly.

References

1. Cisco IOS XE Software Security Hardening Release: August 2026. Cisco Security Advisory, 5 August 2026.

2. Remediate IOS-XE Security Advisory — Aug 2026 and Related Critical Issues. Cisco Wireless TAC / Wireless BU, updated 17 August 2026.

3. Recommended Cisco IOS XE Releases for Catalyst 9800 Wireless LAN Controllers. Cisco Wireless TAC, updated 3 September 2026.

Sources reviewed 18 September 2026.