Modern network systems such as transportation, manufacturing, and communication systems are subject to cyber-physical disruptions. Cyber disruptions compromise sensing and/or actuating which closed-loop control relies on, and physical disruptions undermine network capability. This paper develops a novel approach to analysis and design of traffic control for dynamic flow networks subject to a rather broad class of disruptions. We consider a single-origin-single-destination acyclic network with possibly finite link storage spaces. Both cyber and physical disruptions are modeled as a set of discrete modes that modify the control and/or the network flow dynamics. The network switches between various modes according to a Markov process. By considering switched, piecewise polynomial Lyapunov functions and exploiting monotonicity of the network flow dynamics, we analyze network throughput under various disruption scenarios and show that cyber-physical disruptions can significantly reduce network throughput. For control design, we derive two results analogous to the classical max-flow min-cut theorem: (i) for a network with observable disruption modes, there exist mode-dependent controls that attain the expected-min-cut capacity; (ii) for a network with infinite link storage spaces, there exists an open-loop control that attains the min-expected-cut capacity. We also design a closed-loop control for general cases and derive an explicit relation from the control to a lower-bound for throughput. Our approach is illustrated by a series of numerical examples.