Which Cisco IOS XE release you should run — and why “the latest” is the wrong rule

Networks usually answer the question of the right software version in one of two ways: stay on the commissioning build until something forces a change, or take the newest release at every opportunity. Both are avoidance strategies — one avoids change, the other avoids decision.

Every train has two ends

The most important and most frequently missed point is that “support” means two different things. Maintenance releases bring bug fixes in the broader sense. Security support covers only fixes for vulnerabilities and, according to Cisco's end-of-life bulletins, runs eighteen months longer. Six months after that comes the last date of support, after which the train receives no support at all.

Between the end of maintenance and the end of security support a train sits in a state worth recognising: security holes still get closed, a functional defect does not. For a production campus network that is not a comfortable place — it is permissible, but it should be a decision rather than an accident.

As of 25 September 2026, Cisco has not yet published an end-of-life bulletin with individual dates for 17.18. As an Extended-Support release, the train has 48 months from first customer shipment according to Cisco. The releases in between — 17.10, 17.11, 17.13, 17.14, 17.16, 17.17 — are Standard-Support releases with twelve months. They exist for networks that need a specific new feature early, not as a permanent state.

IOS XE 26: every release becomes long-lived

With 26.1.1 Cisco changed the model. The major number is now the calendar year — 26 stands for 2026. Two releases ship per year, roughly six months apart, and every one of them is an Extended-Support release with 48 months from general availability. The distinction between long-lived and short-lived disappears for new releases.

The question “which release, and until when?” remains. For Catalyst 9200 to 9600, Cisco still recommends 17.18.4 and 17.15.6 as of 4 September 2026; the page carries no recommendation for 26.x yet. Planning today therefore still means planning on 17.x and preparing the move to 26.

That preparation includes one point that otherwise surprises: from 17.18.2 IOS XE warns about configurations Cisco classifies as insecure, and from 26.1.1 it restricts them. According to Cisco, a device upgraded to 26 with such commands in place automatically enables “system mode insecure” so that nothing breaks — which also means it is not hardened. A new device without a startup configuration rejects the same commands instead; a template carried over from the old estate then fails precisely when a device is replaced. The command “show system insecure profile” lists every command Cisco classifies as insecure, and from 26.1.1 “show system insecure configuration” shows the ones a device actually uses. A device can only leave that mode once all insecure configuration has been removed.

Why “the latest” is the wrong rule

Up to 17.18 the newest release was rarely a long-lived train. From 26 onwards it always is, formally — but it is still the least proven. A campus network does not need an early feature; it needs predictability: the same version on as many devices as possible, over a period long enough that its behaviour is known.

The usable rule therefore has three conditions. First: a long-lived train — every third one up to 17.18, every release from 26. Second: not the newest one but one with operational experience that still has years of maintenance ahead. Third: the move is planned before maintenance releases end, not after.

There is a recurring exception: a feature you genuinely need that exists only in a newer train. Then the decision is defensible — but it is an exception with a reason, not the rule.

How an upgrade runs without hurting

1. 01

   Take stock

   Which device runs which version? Read from the network, not from the documentation. Almost every survey surfaces at least one train nobody knew was still running.

2. 02

   Fix the target version

   One train per platform class, justified against the support end dates. Two target versions in one campus are sometimes necessary; three are a symptom.

3. 03

   Test path

   One device per model and role, in an environment where a fault costs nothing. Test not just the boot but what your network actually uses: authentication, voice VLAN, multicast, stacking, uplink behaviour — and, for the move to 26, the commands classified as insecure.

4. 04

   Staged rollout

   An uncritical area first, then a floor, then the rest — with defined observation periods in between. A rollout without pauses is a rollout without an abort option.

5. 05

   Evidence and repeatability

   The state after the rollout is captured and checked against the intended state. Once described as a procedure, the next train costs a fraction.

In environments with a network controller, software distribution is exactly the task it was built for: define the target image, surface the drift, distribute in stages, log the result. How we set that up is described under Cisco Catalyst Center; its place in wider operations under enterprise networks.

Why this matters right now

Three developments meet. First, security support for 17.9 ends on 30 September 2026, and 17.12 has been past its maintenance releases since 30 March 2026 — both trains still running in many networks. Second, on 5 August 2026 Cisco published a hardening release for IOS XE: vulnerabilities up to CVSS 9.8, no workarounds, fixed in 17.9.10, 17.12.8, 17.15.6, 17.18.4 and 26.1.2. Third, IOS XE 26 turns the choice of train into a question of timing rather than cadence.

Such publications have become predictable: since July Cisco reserves the first and third Wednesday of each month for security-hardened software and names the affected platforms seven days ahead. Aligning maintenance windows with that schedule means patching to plan rather than to headlines.

The inventory is therefore the most rewarding first step. It costs a day and answers whether you have a planning topic or an acute one. Platforms that no longer receive a current IOS XE at all belong on the same list — see our replacement plan for Catalyst 2960-X and 3650.