What is the CVSS score of CVE-2026-20040?

CVE-2026-20040 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ios Xr are affected by CVE-2026-20040?

A critical vulnerability in Cisco IOS XR CLI allows authenticated local users to gain root-level command execution on affected network devices.

How to fix or mitigate CVE-2026-20040?

Within 24 hours: Identify all Cisco IOS XR devices in your environment and document their versions and access controls. Within 7 days: Implement strict local access restrictions, disable unnecessary CLI features where possible, and enforce multi-factor authentication for all local administrative access. Within 30 days: Monitor Cisco security advisories for patch availability and establish a priority deployment plan; consider network segmentation to limit lateral movement from compromised devices.

Ios Xr CVE-2026-20040

HIGH

OS Command Injection (CWE-78)

2026-03-11 psirt@cisco.com

Cisco Apple Command Injection Ios Xr

8.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.

This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.

AnalysisAI

Insufficient CLI argument validation in Cisco IOS XR Software enables authenticated local attackers to achieve root-level code execution through crafted commands. An attacker with low-privileged account access can exploit this vulnerability to bypass privilege restrictions and execute arbitrary commands on the affected device's underlying operating system. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects CLI of Cisco IOS XR Software. A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.