What is the CVSS score of CVE-2026-20074?

CVE-2026-20074 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ios Xr are affected by CVE-2026-20074?

A high-severity vulnerability in Cisco IOS XR's IS-IS routing feature allows adjacent network attackers to crash the routing process, potentially disrupting network connectivity and business…

How to fix or mitigate CVE-2026-20074?

Within 24 hours: Inventory all Cisco IOS XR devices using IS-IS multi-instance routing and assess network adjacency exposure. Within 7 days: Implement network segmentation to restrict IS-IS adjacency to trusted devices only, disable IS-IS multi-instance routing if operationally feasible, or deploy enhanced monitoring for IS-IS process restarts. Within 30 days: Establish vendor communication channels for patch availability updates and develop detailed incident response procedures specific to IS-IS process failures.

Ios Xr CVE-2026-20074

HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-03-11 psirt@cisco.com

Cisco Denial Of Service Apple Ios Xr

7.4

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.4 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly.

This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition. Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency.  

AnalysisAI

Cisco IOS XR Software's IS-IS routing implementation fails to properly validate incoming protocol packets, enabling an adjacent network attacker to trigger repeated process crashes and temporary routing outages. An attacker with Layer 2 adjacency can send malformed IS-IS packets to force denial of service conditions affecting network connectivity. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly.